Re: Re: CVE Request: xdg-utils: xdg-open: command injection vulnerability

[Michael Gilbert <michael.s.gilbert () gmail com>]

On Wed, Feb 18, 2015 at 1:35 PM, CVE assign wrote:
> Our understanding from
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777722#12 is that
> the report has not identified a vulnerability (or even a bug) in dash.

It is probably at least a design flaw (and a reasonably
well-documented one at that [0]).  Bash on the other hand is not
vulnerable to the same class of problems:

$ cat testme
testme() {
   x=backfromthedead
   local x
   echo $x
}
testme

$ bash testme

$ dash testme
backfromthedead

Best wishes,
Mike

[0] $ man dash