Description
Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | chicken | 4.8.0.3-1 | — |
| Debian 13 | chicken | 4.8.0.3-1 | — |
| Debian 12 | chicken | 4.8.0.3-1 | — |
References
- 91520 vdb-entry
- chicken-cve20131874-csirc-code-execution(85065) vdb-entry
- http://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=blob%3Bf=NEWS%3Bh=c21c7cf9d1faf4f78736890ac7ca1d4b82d72ddd%3Bhb=c6750af99ada7fa4815ee834e4e705bcfac9c137
- 58583 vdb-entry
- [oss-security] 20130319 Untrusted startup file inclusion in Chicken Scheme mailing-list