An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for fish ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0405-1 Rating: moderate References: #1217808 Cross-References: CVE-2023-49284 CVSS scores: CVE-2023-49284 (NVD) : 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H CVE-2023-49284 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for fish fixes the following issues: - CVE-2023-49284: Fixed shell expansion triggered by command substitution output (boo#1217808). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-405=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): fish-3.3.1-bp155.4.3.1 fish-devel-3.3.1-bp155.4.3.1 References: https://www.suse.com/security/cve/CVE-2023-49284.html https://bugzilla.suse.com/1217808 . The latest openSUSE upgrade tackles a significant security flaw within the fish shell. Ensure you implement this update to bolster your system's protection.. openSUSE Fish Update, Security Patch, Command Substitution Fix. . LinuxSecurity.com Team
Mageia 9 is updated to version 3.6.4 to fix CVE-2023-49284. Mageia 8 receives an upstream patch to fix CVE-2023-49284. CVE-2023-49284: fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command substitution output, rather . MGASA-2023-0344 - Updated fish packages fix a security vulnerability Publication date: 12 Dec 2023 URL: https://advisories.mageia.org/MGASA-2023-0344.html Type: security Affected Mageia releases: 8, 9 CVE: CVE-2023-49284 Mageia 9 is updated to version 3.6.4 to fix CVE-2023-49284. Mageia 8 receives an upstream patch to fix CVE-2023-49284. CVE-2023-49284: fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command substitution output, rather than transforming them into a safe internal representation. References: - https://bugs.mageia.org/show_bug.cgi?id=32614 - https://www.cve.org/CVERecord?id=CVE-2023-49284 SRPMS: - 8/core/fish-3.4.1-1.1.mga8 - 9/core/fish-3.6.4-1.mga9 . The recent Mageia 9 update enhances the fish shell, fixing the CVE-2023-49284 vulnerability and includes upstream patches for Mageia 8 users too. Mageia Security Advisory, Fish Shell Update, Unicode Command Issue. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.