Date: Thu, 07 Sep 2000 16:34:17 -0600 From: Warner Losh <imp@village.org> To: Kris Kennaway <kris@FreeBSD.org> Cc: "Todd C. Miller" <Todd.Miller@courtesan.com>, "Vladimir Mencl, MK, susSED" <mencl@nenya.ms.mff.cuni.cz>, freebsd-security@FreeBSD.org, security-officer@FreeBSD.org, millert@openbsd.org Subject: Re: UNIX locale format string vulnerability (fwd) Message-ID: <200009072234.QAA07199@harmony.village.org> In-Reply-To: Your message of "Thu, 07 Sep 2000 15:32:42 PDT." <Pine.BSF.4.21.0009071532190.25298-100000@freefall.freebsd.org> References: <Pine.BSF.4.21.0009071532190.25298-100000@freefall.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
In message <Pine.BSF.4.21.0009071532190.25298-100000@freefall.freebsd.org> Kris Kennaway writes: : On Thu, 7 Sep 2000, Warner Losh wrote: : : > In message <Pine.BSF.4.21.0009071520310.16976-100000@freefall.freebsd.org> Kris Kennaway writes: : > : I think all of the following can be pointed to arbitrary files as well : > : in setlocale(): : > : "LANG" : > : > LANG cannot. If it contains /, it is ignored. : : setlocale(), not catopen(). It is treated on the same footing as all of : the others, there. Ah, it shouldn't :-) Warner To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200009072234.QAA07199>