https://bugzilla.redhat.com/show_bug.cgi?id=1526142
Pedro Yóssis Silva Barbosa <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |[email protected] --- Comment #2 from Pedro Yóssis Silva Barbosa <[email protected]> --- Created attachment 1375842 --> https://bugzilla.redhat.com/attachment.cgi?id=1375842&action=edit help function calls Using a crafted URL, it is possible to inject command. gbg> b *0x56f9bf gdb> run --help gbg> printf "%s", $rdi "xdg-open" "http://fontforge.sf.net/overview.html"; & The thing is, though, the URL values seem to be all hardcoded and not possible to craft remotely (see attachment). -- You are receiving this mail because: You are on the CC list for the bug. _______________________________________________ fonts-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected]
