bug#60924: gunzip susceptible to PATH highjacking

2023-01-17 Thread Peter Hutterer
Hi all, Simple summary: gunzip executes any "gzip" executable if the caller adjusts PATH. $ echo "boom" > gzip $ chmod +x gzip $ PATH="$PWD:$PATH" /usr/bin/gunzip boom We discovered this as part of a fix to libXpm, an library to parse X pixmaps. libXpm forks out to gunzip to decompress an xpm.g

bug#60924: gunzip susceptible to PATH highjacking

2023-01-17 Thread Paul Eggert
On 2023-01-17 20:39, Peter Hutterer wrote: Not sure if this is a bug, intentional, or just a "meh, too niche to worry about". I'd say it's intentional. These days you're probably better off linking to zlib instead.