<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On 19 January 2015 at 13:57, Maxin B. John <span dir="ltr"><<a href="mailto:maxin.john@enea.com" target="_blank">maxin.john@enea.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div id=":6b" class="a3s" style="overflow:hidden">On Wed, Jan 07, 2015 at 01:11:43PM +0100, Maxin B. John wrote:<br>
> Fiedler Roman discovered that coreutils' parse_datetime() function<br>
> has some flaws that may be exploitable if the date(1), touch(1),<br>
> or potentially other programs, accept untrusted input for certain<br>
> parameters. While researching this issue, he discovered that it<br>
> was independently discovered by Bertrand Jacquin and reported at<br>
> <a href="http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16872" target="_blank">http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16872</a><br>
></div></blockquote><div><br></div><div>Was this bug still in 8.23 so it needs to be applied to master, or is it dizzy-specific?</div><div><br></div><div>Ross </div></div></div></div>