Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
ccbc10b41f
NetBSD/usr.bin
History
christos 2a8765d5a2 Fix various security related issues: 
0001. Do not recognize paths, mail folders, and pipes in mail addresses
    by default.  That avoids a direct command injection with syntactically
    valid email addresses starting with |.

    Such addresses can be specified both on the command line, the mail
    headers (with -t) or in address lines copied over from previous
    while replying.

    This was assigned CVE-2014-7844 for some versions of BSD mailx.  It is
    documented behavior for Heirloom mailx, and was mentioned in an old
    technical report about BSD mailx (which does not usually make its way
    into operating system installations).  The patch switches off this
    processing and updates the documentation.

Added expandaddr option to explicitly enable this behavior.

    0002. When invoking sendmail, prevent option processing for email
    address arguments.  This prevents changing e.g. the Postfix
    configuration file in unexpected ways.  This behavior was documented for
    BSD mailx (sort of), but not for Heirloom mailx.  We did not assign a
    CVE to this because it is more of a missing feature, and code invoking
    mailx needs adjustment in the caller as well.

Fixed.

    0003. Make wordexp support mandatory.  (No functional change.)

Fixed (replaced explicit shell pipe implementation).

    0004. Prevent command execution in the expand function, which is IMHO
    unexpected.  (Not really required with patch 1, and there is still
    information disclosure/DoS potential if this expansion occurs.)  This is
    a historic vulnerability already fixed in the Debian package,
    retroactively assigned CVE-2004-2771:

Fixed (as part of the pipe replacement with wordexp).
2014-12-16 19:30:24 +00:00
..
apply
apropos
asa Change some standard exit status text to ".Ex -std" 2014-04-13 01:45:34 +00:00
at
audio Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
audiocfg Add more __dead. 2013-08-12 14:03:18 +00:00
awk
banner Sync usage with man page. From Bug Hunting in PR 46102. 2012-02-29 08:55:25 +00:00
basename
bdes Use more static and __dead. 2013-08-15 20:48:56 +00:00
biff Add EXIT STATUS section. From Ryan Kavanagh via jmc@openbsd. 2013-04-28 12:43:51 +00:00
bthset Sort sections. From Henning Petersen in PR 49222. 2014-09-19 16:02:58 +00:00
btkey Sort sections. From Henning Petersen in PR 49222. 2014-09-19 16:02:58 +00:00
btpin Sort sections. From Henning Petersen in PR 49222. 2014-09-19 16:02:58 +00:00
bzip2 Adapt to repository move of dist from external/bsd/bzip2 to 2012-05-07 08:51:47 +00:00
bzip2recover Adapt to repository move of dist from external/bsd/bzip2 to 2012-05-07 08:51:47 +00:00
cal
calendar Fix year of Hawaiian Admission Day. From Henning Petersen in PR 49123. 2014-08-17 10:01:14 +00:00
cap_mkdb Change some standard exit status text to ".Ex -std" 2014-04-13 01:45:34 +00:00
cdplay fix the rest of the lint warnings [pass 1] 2013-10-07 15:17:24 +00:00
checknr Add more __dead. 2013-08-12 14:03:18 +00:00
chflags In all man pages that say: 2013-12-17 09:54:08 +00:00
chpass Add capfile(5) to describe the termcap format. 2012-04-21 12:27:24 +00:00
cksum Fix build. 2014-10-29 18:09:35 +00:00
cleantags Move .Op macro to its own line. Fix SYNOPSIS rendering with mandoc. 2013-04-26 17:12:10 +00:00
cmp Explicitly include <stdint.h> for uintmax_t; from Eitan Adler. 2013-11-20 17:19:14 +00:00
col PR/49291: Henning Petersen: Problem with half-line feeds in input stream. 2014-10-18 14:56:14 +00:00
colcrt Change or add history. I checked the 1bsd archives and this first 2012-05-12 14:52:57 +00:00
colrm Change or add history. I checked the 1bsd archives and this first 2012-05-12 14:52:57 +00:00
column
comm Change some standard exit status text to ".Ex -std" 2014-04-13 01:45:34 +00:00
compress
config Revert debug code. Simplify. 2014-12-15 15:49:25 +00:00
crunch Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
csplit Correct number of output files in example. 2014-02-04 19:48:48 +00:00
ctags Change some standard exit status text to ".Ex -std" 2014-04-13 01:45:34 +00:00
cut From Igor Sobrado in private email (based on his OpenBSD commit): 2014-02-03 20:22:19 +00:00
db Fix typo. Bump date for previous. 2012-02-17 11:43:24 +00:00
deroff fix unused variable warnings 2013-10-18 20:47:06 +00:00
dirname
du Add EXIT STATUS section and bump date. 2012-05-14 21:14:14 +00:00
eject racd *should* be ejectable. Kernel side to come 2012-07-14 20:41:27 +00:00
elf2aout Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
elf2ecoff remove unused variables 2013-11-10 17:14:25 +00:00
env
error Don't use non-literal format strings. Split it up depending on the 2012-02-29 23:37:07 +00:00
expand Change or add history. I checked the 1bsd archives and this first 2012-05-12 14:52:57 +00:00
extattr Use returned size and not buffer max length when displaying attribute 2014-06-20 15:22:01 +00:00
false
fdformat Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
fgen fix unused variable warnings 2013-10-18 20:47:06 +00:00
fincore
find src is too big these days to tolerate superfluous apostrophes. It's 2014-10-18 08:33:23 +00:00
finger - Don't dump core or print random junk on corrupt utmp entries. 2013-01-18 22:10:31 +00:00
flock mention that -x is the default. 2014-08-18 09:45:52 +00:00
fmt add -w as an alias to -m 2012-06-30 21:31:15 +00:00
fold Remove trailing whitespace. 2012-05-12 15:17:15 +00:00
fpr Fix whitespace nits. Suggested by Bug Hunting. 2012-03-22 07:58:16 +00:00
from
fsplit Assert equality, not assignment, in fsplit, and say who guarantees it. 2013-01-23 20:39:46 +00:00
fstat src is too big these days to tolerate superfluous apostrophes. It's 2014-10-18 08:33:23 +00:00
ftp Version 20141026 2014-10-31 03:27:18 +00:00
gcore use macro for OS name when first introduced 2014-01-21 02:53:30 +00:00
genassym - use just the basename for program name 2014-01-06 22:43:15 +00:00
gencat Use LIST_FOREACH, LIST_NEXT, etc., instead of direct access to 2013-11-27 17:38:11 +00:00
getaddrinfo need bsd.own.mk 2014-04-29 01:21:02 +00:00
getconf Change some standard exit status text to ".Ex -std" 2014-04-13 01:45:34 +00:00
getent Add __printflike attribution to use vprintf and friends with an argument 2012-03-15 02:02:20 +00:00
getopt
gprof Reorg docs, part 1: 2014-07-05 19:22:41 +00:00
grep fix type, from enh at google dot com 2014-07-14 21:56:03 +00:00
gzip src is too big these days to tolerate superfluous apostrophes. It's 2014-10-18 08:33:23 +00:00
head
hesinfo Use C89 function definitions 2012-03-20 20:34:57 +00:00
hexdump don't read random garbage from the stack 2013-10-18 20:19:03 +00:00
iconv Save errno around fwrite(), which can otherwise trash it; PR 47813. 2013-10-07 02:00:46 +00:00
id
indent port the -ut / -nut options from freebsd. -ut (default) enables tabs 2014-09-04 04:06:07 +00:00
infocmp Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
innetgr Use C89 function definitions 2012-03-20 20:34:57 +00:00
ipcrm
ipcs Remove KVM support. 2014-06-11 14:57:55 +00:00
join Remove unnecessary Bk/Ek pairs from SYNOPSIS. 2012-04-08 22:00:37 +00:00
jot Remove unnecessary Bk/Ek pairs from SYNOPSIS. 2012-04-08 22:00:37 +00:00
kdump Fix compat netbsd32 syscall return values display by calling 2014-04-30 11:51:51 +00:00
klist
ktrace use O_CLOEXEC. 2013-01-24 17:47:58 +00:00
ktruss mremap(2) return an pointer just like mmap(2). 2012-07-17 14:39:08 +00:00
lam Adjust case of example to match usage (and code) 2012-12-13 21:09:34 +00:00
last Change or add history. I checked the 1bsd archives and this first 2012-05-12 14:52:57 +00:00
lastcomm Sync usage with man page. 2012-01-31 21:53:42 +00:00
ldd Fix ldd on LP64 platforms by splitting the symbol versioning stuff for 2014-08-28 12:23:29 +00:00
leave Now that window(1) is gone, use tmux(1) for xref. 2012-02-21 15:01:51 +00:00
locale
locate Synchronise several shell_quote implementations, and: 2014-08-04 21:56:30 +00:00
lock fix unused variable warnings 2013-10-18 20:47:06 +00:00
logger Small typo in macro. 2012-05-13 17:08:31 +00:00
login Remove the syslogging of a dial out login warning based on the tty name, because 2014-11-12 22:23:38 +00:00
logname
look Don't use while-loop with empty body. 2012-02-23 22:57:53 +00:00
lorder Fix whitespace nits. Suggested by Bug Hunting. 2012-03-22 07:58:16 +00:00
m4 Rework /usr/share/doc. 2014-07-05 19:22:02 +00:00
machine
mail Fix various security related issues: 2014-12-16 19:30:24 +00:00
make Ensure -- filemon is at start of line 2014-11-06 01:36:57 +00:00
man More detail about treating a local file as a man page, 2014-08-14 15:44:47 +00:00
menuc avoid redefinitions 2013-10-18 20:19:36 +00:00
mesg
midiplay
mixerctl Fix indent and style. no functional changes. 2012-10-28 02:01:15 +00:00
mkcsmapper
mkdep Conditionally include the depend files. 2013-03-05 21:57:47 +00:00
mkesdb
mkfifo
mklocale Fix description of hex encoding. 2013-07-15 18:46:47 +00:00
mkstr Change or add history. I checked the 1bsd archives and this first 2012-05-12 14:52:57 +00:00
mktemp minor wording nits and a typo fix 2014-11-10 07:33:31 +00:00
mkubootimage Use An in AUTHORS section. 2014-09-30 10:30:35 +00:00
moduli
msgc avoid redefinitions 2013-10-18 20:19:36 +00:00
msgs Fix documentation of how to expire old messages. For some reason the 2013-11-24 19:49:22 +00:00
nbperf Most CPUs implement shifts modulo the width, but ARM doesn't. Don't 2014-04-30 21:04:58 +00:00
nbsvtool
netgroup Use C89 function definitions 2012-03-20 20:34:57 +00:00
netstat PR/47704: Takahiro HAYASHI: Fix -L flag 2014-11-12 03:34:59 +00:00
newgrp PR/47319 use addgrp_ret_t instead of magic values 2014-06-23 06:57:31 +00:00
newsyslog Revert previous, it was wrong. 2013-12-20 17:01:39 +00:00
nfsstat PR/48426: Dimitris Karagkasidis: Make nfsstat use unsigned numbers. 2014-04-24 18:40:35 +00:00
nice Fix whitespace nits. Suggested by Bug Hunting. 2012-03-22 07:58:16 +00:00
nl Improve description. 2013-09-24 22:08:06 +00:00
nohup Punctuation. 2012-03-29 18:33:19 +00:00
pagesize
passwd Keep the built-in support for passwd -k, but don't make the kpasswd link or 2013-02-13 23:19:14 +00:00
paste Remove second NetBSD RCS Id. 2013-04-07 17:43:01 +00:00
patch PR/49422: Ryo ONODERA: patch(1) cannot handle context diffs 2014-11-27 15:07:23 +00:00
pathchk
pkill Document that patterns are specified using extended regular expressions. 2013-11-01 07:49:00 +00:00
pmap Change some standard exit status text to ".Ex -std" 2014-04-13 01:45:34 +00:00
pmc Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
pr - Fix optional argument options (e, i, n, s) in SYNOPSIS and DESCRIPTION 2012-08-01 02:36:17 +00:00
printenv
printf Change some standard exit status text to ".Ex -std" 2014-04-13 01:45:34 +00:00
progress Change some standard exit status text to ".Ex -std" 2014-04-13 01:45:34 +00:00
pwhash
qsubst Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
quota Remove leftover #if 0 code from before the libquota rework. 2014-07-13 01:46:04 +00:00
radioctl
rdist more clobbering fixes. 2013-10-18 20:43:45 +00:00
renice emove duplicate RCS Id. Bump date for previous. 2012-12-06 07:52:12 +00:00
rev
revoke
rfcomm_sppd Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
rlogin Sync usage with man page. 2013-03-02 18:37:19 +00:00
rpcgen Sync usage and option descriptions with manpage. 2013-12-15 09:18:31 +00:00
rpcinfo passes WARNS=5, don't set it to 4. 2013-08-21 21:05:29 +00:00
rs
rsh Changes done in rsh.c rev. 1.36 was incomplete. As chuq pointed 2014-11-26 23:44:21 +00:00
rump_allserver Use autoconf for rump kernel posix hypercall layer. 2014-11-04 19:05:17 +00:00
rump_dhcpclient Don't use const foo const as type, one const is enough. 2012-09-13 21:44:49 +00:00
rump_halt Use autoconf for rump kernel posix hypercall layer. 2014-11-04 19:05:17 +00:00
rump_server Support disklabel partitions on all platforms. 2013-11-13 17:47:27 +00:00
rump_wmd Clarify that -l params must be given after options. 2014-01-28 14:02:54 +00:00
rup src is too big these days to tolerate superfluous apostrophes. It's 2014-10-18 08:33:23 +00:00
ruptime Remove second copy for RCS Id. 2014-01-04 15:43:27 +00:00
rusers Fix whitespace nits. Suggested by Bug Hunting. 2012-03-22 07:58:16 +00:00
rwall
rwho
script
sdiff Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
sdpquery Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
sed PR/49109: Jeremie Le Hen: fix sed relative addressin (1,+N) 2014-08-13 11:35:34 +00:00
seq * Punctuation 2013-04-07 17:37:45 +00:00
shar Fix whitespace nits. Suggested by Bug Hunting. 2012-03-22 07:58:16 +00:00
shlock Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
shmif_dumpbus Use autoconf for rump kernel posix hypercall layer. 2014-11-04 19:05:17 +00:00
showmount src is too big these days to tolerate superfluous apostrophes. It's 2014-10-18 08:33:23 +00:00
shuffle
skey
skeyinfo
skeyinit Fix capitalisation (again, last time the wrong sentence). 2013-05-06 13:44:17 +00:00
sockstat Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
soelim Change or add history. I checked the 1bsd archives and this first 2012-05-12 14:52:57 +00:00
sort fix unused variable warnings 2013-10-18 20:47:06 +00:00
spell Spell NULL pointer as NULL. 2013-11-18 19:55:59 +00:00
split
stat Change some standard exit status text to ".Ex -std" 2014-04-13 01:45:34 +00:00
su Sort sections. From Henning Petersen in PR 49222. 2014-09-19 16:02:58 +00:00
systat Remove fagile test which ensured that first namelist element (was 2014-06-20 07:08:15 +00:00
tabs Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
tail Fix -f description: it is also ignored if stdin is a FIFO. 2014-06-15 11:37:56 +00:00
talk - use warn/err 2012-12-29 23:44:22 +00:00
tcopy
tee use more appropriate types 2013-03-06 11:44:11 +00:00
telnet Remove many HAVE_GCC || HAVE_PCC conditionals as the options also apply 2012-08-10 12:10:27 +00:00
tftp Work around "variable might be clobbered by longjmp" gcc warning when compiling with CPUFLAGS=-march=armv7. Should be fixed properly one day... 2013-03-29 18:53:21 +00:00
tic use hdestroy1 now that hdestroy does not free the key. 2014-07-20 20:20:16 +00:00
time
timeout Fix overflow check. From Kamil Rytarowski. 2014-08-05 08:20:02 +00:00
tip Remove broken snprintf usage (noted in PR 47976) and replace with 2014-07-27 04:32:23 +00:00
touch Note that -d, -r, and -t are mutually exclusive and only the last one 2012-10-24 02:46:25 +00:00
tpfmt make the result stable. 2012-02-03 05:06:08 +00:00
tput Use putp(3) to output our strings. 2013-02-05 11:31:56 +00:00
tr Whitespace. 2013-08-11 01:54:35 +00:00
true
tset Change or add history. I checked the 1bsd archives and this first 2012-05-12 14:52:57 +00:00
tsort
tty
ul Add capfile(5) to describe the termcap format. 2012-04-21 12:27:24 +00:00
uname
unexpand
unifdef PR/47068: unifdef(1) with cpp directive on last line without newline 2012-10-13 18:26:03 +00:00
uniq - synchronize `usage' message with man page. 2012-08-26 14:14:16 +00:00
units Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
unvis RFC 1866 does not define any "URI encoding". It defines HTML 2.0 that 2012-12-15 02:08:13 +00:00
unzip Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
usbhidaction use O_CLOEXEC 2013-01-24 17:46:00 +00:00
usbhidctl Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
users Use C89 function definitions 2012-03-20 20:34:57 +00:00
utoppya Merge riastradh-drm2 to HEAD. 2014-03-18 18:20:35 +00:00
uudecode Support both "-" and "/dev/stdout" as references to standard 2013-01-28 19:50:30 +00:00
uuencode Sort sections. Remove trailing whitespace. 2014-09-06 21:21:36 +00:00
uuidgen
vacation PR/47689: rudolf: reference to sendmail(8) instead of (1) in vacation(1) 2013-03-24 21:00:22 +00:00
vgrind Sort sections. From Henning Petersen in PR 49222. 2014-09-19 16:02:58 +00:00
videoctl
vis Sort options in SYNOPSIS/usage. 2014-09-26 02:20:39 +00:00
vmstat Trailing whitespace. 2014-09-12 16:25:55 +00:00
vndcompress Fix vndcompress restart failure fallback when input is a pipe. 2014-11-18 03:48:17 +00:00
w redo the previous; avoid a bunch of processing when running as "uptime", 2014-12-03 06:12:19 +00:00
wall
wc Sort sections. From Henning Petersen in PR 49222. 2014-09-19 16:02:58 +00:00
what
whatis
whereis Sort sections. From Henning Petersen in PR 49222. 2014-09-19 16:02:58 +00:00
who Handle ctime() failure. 2014-06-08 09:53:43 +00:00
whois It helps to separate arguments from the query. 2013-02-20 09:27:52 +00:00
write
xargs Remove a few unneeded Pp macros. 2012-10-13 14:18:16 +00:00
xinstall mtree spec files want nanoseconds, so multiply the microseconds by 1000. 2014-07-06 20:54:47 +00:00
xlint allow c99 flexible arrays for packed structures. 2014-11-20 21:17:18 +00:00
xstr
yes
ypcat New sentence, new line. Wording. 2012-03-04 11:54:06 +00:00
ypmatch New sentence, new line. Wording. 2012-03-04 11:54:06 +00:00
ypwhich src is too big these days to tolerate superfluous apostrophes. It's 2014-10-18 08:33:23 +00:00
Makefile PR/49053: Kamil Rytarowski: Import timeout(1) from FreeBSD 2014-08-01 14:01:30 +00:00
Makefile.inc Default to WARNS=5 2012-03-21 05:47:53 +00:00