Chet Ramey <[email protected]> writes: > My favorite was the one where someone (not this reporter) reported a > security bug in bash that essentially consisted of: > > 1. Change the permissions on the shell to setuid root > 2. Imagine the chaos! > > They wanted a CVE, too. I don't think they got one.
Hahaha. Another funny one was the critical vulnerability in GNU coreutils 'printf' using user input as a format string [1]. Maybe you should check the bash builtin for that one. :) Collin [1] https://debbugs.gnu.org/cgi/bugreport.cgi?bug=80802
