Sebastian Krahmer (Security Engineer at SuSE)reported a command injection flaw in blkid. This could possibly result in command execution with root privileges (for example, when running blkid on a malicious USB drive): http://www.openwall.com/lists/oss-security/2014/11/26/13 Fixed in upstream tree, commit: https://github.com/karelzak/util-linux/commit/89e90ae7b2826110ea28c1c0eb8e7c56c3907bdc References: https://github.com/karelzak/util-linux/commit/89e90ae7b2826110ea28c1c0eb8e7c56c3907bdc http://www.openwall.com/lists/oss-security/2014/11/26/13 https://bugzilla.redhat.com/show_bug.cgi?id=1168485 https://security-tracker.debian.org/tracker/CVE-2014-9114
I'll check whether it's fixed in the new stable version. If not, I'll send out a patch once the util-linux upgrade patch is merged. //Chen Qi
The problem is fixed upstream. Upgrading util-linux to 2.26 would solve this problem. As upgrading packages is considered as a feature, at this moment, I'm going to backport the corresponding patch to fix this problem. //Chen Qi
Module: openembedded-core.git Branch: master Commit: 6a5c24f22621f41b17267a6ebedecec631d0156d URL: http://git.openembedded.org/?p=openembedded-core.git&a=commit;h=6a5c24f22621f41b17267a6ebedecec631d0156d