2 results · Feed
-
Medium 4.0
Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservation
A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c …
-
Medium 5.5
Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern su…