Out-of-bounds write of one or two bytes when the printf builtin (and echo %b) converts a \u or \U Unicode escape into a multi-byte sequence. dash 0.5.12 has no \u or \U escapes. conv_escape() in src/b
Out-of-bounds write of one or two bytes when the printf builtin (and echo %b) converts a \u or \U Unicode escape into a multi-byte sequence. dash 0.5.12 has no \u or \U escapes. conv_escape() in src/bltin/printf.c handles only \\ \a \b \f \n \r \t \v and octal escapes; Debian's patch 0008-Support-e-in-echo-and-printf-builtins adds \e and nothing else. The Unicode-escape conversion arrived with upstream's "dollar single quote" work and was first released in dash 0.5.13. Trixie ships 0.5.12-12. MUST re-evaluate if trixie moves dash to 0.5.13 or later.
ECHO-a40f-fcbc-6816
Primary source · Revision 1 · Withdrawn
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:ECHO-a40f-fcbc-6816
dash
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.5.12-12
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.12-12"
}
]
}
],
"package": {
"name": "dash",
"purl": "pkg:deb/echo/dash",
"ecosystem": "Echo"
},
"database_specific": {
"source": "https://advisory.echohq.com/osv/ECHO-a40f-fcbc-6816.json"
}
}
]- Related CVEs
- CVE-2026-102474
Source reference:
/upstream
Publisher severity
No explicit severity was provided.
- Event
- #81605 · Revision 1
- Added to Heist Feed
- Publisher date