Zsh Mailing List Archive
Messages sorted by: Reverse Date, Date, Thread, Author

Re: Zsh - Multiple DoS Vulnerabilities

Stephane Chazelas wrote on Tue, 14 May 2019 18:11 +00:00:
> IMO, from a security standpoint, it's not very useful to fuzz
> "code" input provided to zsh, as anyway any "code" allows zsh to
> run any arbitrary command (except for the restricted mode). In
> other words, the "code" is generally not the attacker supplied
> data.

Sounds right.  There might be some corner case here 

> You could fuzz environment variables (the ones zsh cares
> about) or other attacker-controlled data fed to zsh scripts like
> "limits" instead.
Messages sorted by: Reverse Date, Date, Thread, Author