3 ms·
Yeah, I was current yesterday and I'm current today, with both apt-get update and upgrades. Your version number is lower than mine, you must be on either stabl
by yebyen 12y ago
Yeah, I was current yesterday and I'm current today, with both apt-get update and upgrades. Your version number is lower than mine, you must be on either stable or testing.
ii bash 4.3-9 i386 GNU Bourne Again SHell
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
From the FAQ:
> Does sid have security updates?
Not in the same sense that stable does. If the maintainer of a package fixes a security bug and uploads the package, it'll go into sid by the normal means. If the maintainer doesn't do that, then it won't. The security team only covers stable (and possibly testing... there's a pending issue for that case).
- _delirium 12y agosid/unstable had a fix uploaded ~3 hrs ago fwiw (after you made your comment).
- csirac2 12y agoOnly for amd64 though, ctrl+f for "4.3-9.1": http://ftp.debian.org/debian/pool/main/b/bash/ http://ftp.debian.org/debian/pool/main/b/bash/
- yebyen 12y agoYep. A current i386 debian is still vulnerable, some hours later. Curses. Edit: I see that even those who got the patch are in fact still vulnerable.