> resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed

> resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed. The fix consists of implementing an XXX present since the code was added: /* * XXX validate that domain name only contains valid characters * for two reasons: 1) correctness, 2) we do not want to pass * possible malicious, unescaped characters like `` to a script * or program that could be exploited that way. */ https://www.freebsd.org/security/patches/SA-25:12/rtsold.patch https://www.freebsd.org/security/patches/SA-25:12/rtsold.pat...