Package: bash Version: 5.2.15-2+b13 Severity: normal Tags: upstream Dear Maintainer,
The following segfaults: #!/bin/bash set -e ulimit -c unlimited tmpgz=$(mktemp) curl -o "$tmpgz" https://ytec.nl/media/many_lines_redacted.txt.gz many_lines=$(zcat "$tmpgz") echo -e "$many_lines" > /dev/null To not use the untrusted file, this can be used too, but for me it OOMS before crashes: bash -c 'v=$(yes | head -n 1000000000); echo -e "$v" >/dev/null; echo ok' Reported and confirmed to exist upstream in git master: https://lists.gnu.org/archive/html/bug-bash/2026-09/msg00010.html So, affected versions are probably all, not just this Debian 12 system. It's possibly a security problem, but I did not take the time to try to exploit it. -- System Information: Debian Release: 12.15 APT prefers oldstable-updates APT policy: (500, 'oldstable-updates'), (500, 'oldstable-security'), (500, 'oldstable') Architecture: amd64 (x86_64) Kernel: Linux 6.1.0-44-amd64 (SMP w/8 CPU threads; PREEMPT) Kernel taint flags: TAINT_WARN Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages bash depends on: ii base-files 12.4+deb12u15 ii debianutils 5.7-0.5~deb12u1 ii libc6 2.36-9+deb12u14 ii libtinfo6 6.4-4 Versions of packages bash recommends: ii bash-completion 1:2.11-6 Versions of packages bash suggests: pn bash-doc <none> -- no debconf information
