Re: Insecure _PATH_DEFPATH in dietlibc

Christian Seiler <[email protected]> Mon, 18 Jul 2016 22:31:50 +0200

Newsgroups	gmane.linux.lib.dietlibc
Message-ID	<[email protected]>

On 07/18/2016 10:53 AM, Thorsten Glaser wrote:
> $ fgrep DEFPATH /usr/lib/diet/include/paths.h
> #define _PATH_DEFPATH "/bin:/usr/bin:"
> 
> this includes the current working directory.

Thanks for cc'ing me.

Felix: if I don't here any contrary opinion until tomorrow,
I'll prepare fixes for Debian that replace the string with
"/bin:/usr/bin". (Which is what glibc uses for
confstr(_CS_PATH).)

Regards,
Christian