Package: zsh
Version: 5.2-5
Severity: normal
Dear Maintainer,
Zsh just repeats the same number when $RANDOM is requested in fresh
subshells. In general, this sort of bug is a security vulnerability,
though I'm not aware of anyone doing security-sensitive stuff in zsh.
bash handles this correctly in variables.c by checking
`subshell_environment && seeded_subshell != pid` on every call and
reseeding then; it would also be possible to use `pthread_atfork` (or,
since the forking is entirely within the main executable, just the
manual equivalent at the call site).
See also tests/varenv.sh in the bash source package.
Simple test case:
zsh -c 'for I in {0..9}; do ( echo $RANDOM ); done; echo $RANDOM; for I in
{0..9}; do ( echo $RANDOM ); done'
-- Package-specific info:
Packages which provide vendor completions:
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-=================-======================-============-=======================================================
ii 0install-core 2.10-2 amd64 cross-distribution
packaging system (non-GUI parts)
ii cmus 2.7.1+git20160225-1+b1 amd64 lightweight ncurses
audio player
ii curl 7.47.0-1 amd64 command line tool for
transferring data with URL syntax
ii git-buildpackage 0.7.5 all Suite to help with
Debian packages in Git repositories
ii mpv 0.14.0-1+b2 amd64 video player based on
MPlayer/mplayer2
ii pulseaudio 8.0-2+b2 amd64 PulseAudio sound
server
ii reprepro 4.17.1-1 amd64 Debian package
repository producer
ii systemd 230-2 amd64 system and service
manager
ii systemd-container 230-2 amd64 systemd
container/nspawn tools
ii systemd-coredump 230-2 amd64 tools for storing and
retrieving coredumps
ii udev 230-2 amd64 /dev/ and hotplug
management daemon
ii vlc-nox 2.2.4-2 amd64 multimedia player and
streamer (without X support)
dpkg-query: no path found matching pattern /usr/share/zsh/vendor-functions/
-- System Information:
Debian Release: stretch/sid
APT prefers testing-debug
APT policy: (600, 'testing-debug'), (600, 'testing'), (500,
'unstable-debug'), (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386, x32
Kernel: Linux 4.5.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages zsh depends on:
ii dpkg 1.18.7
ii libc6 2.22-11
ii libcap2 1:2.25-1
ii libtinfo5 6.0+20160319-1
ii zsh-common 5.2-5
Versions of packages zsh recommends:
ii libncursesw5 6.0+20160319-1
ii libpcre3 2:8.38-3.1
Versions of packages zsh suggests:
pn zsh-doc <none>
-- no debconf information
