Researchers backdoored Bash on GNU Savannah via email injection
Email injection enabled RCE, superuser access, and push to Bash repo; FSF fixed 26 Savane vulnerabilities after report.
70
- Mentions · 7d0
- Mentions · 30d2
- All mentions7
- First seenSep 16, 2026
- Last mentioned9d ago
Timeline
7 articles · newest firstYour C is not standard C
A developer blog lists practical mismatches between ISO C and GCC, Clang, glibc, and musl.
6
Re: CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
Simon McVittie questions whether libextractor CVE-2026-100310 is a realistic setuid privilege escalation.
34
CVE-2026-95510: GNU Inetutils: use of uninitialized struct sigaction
GNU Inetutils CVE-2026-95510 uses an uninitialized sigaction in rlogin, rlogind, and telnetd, risking crashes.
38
CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
GNU libextractor before 1.16 can be locally escalated via the LIBEXTRACTOR_PREFIX search path.
46
Re: GNU Emacs vulnerability upon opening arbitrary file
CVE-2026-96269 was assigned to a GNU Emacs flaw triggered by opening an arbitrary file.
34
CVE-2026-91752: GNU libextractor < 1.15 Stack Overflow via OLE2
GNU libextractor before 1.15 has a stack-based buffer overflow (CVE-2026-91752) in its OLE2 parser, triggerable via crafted files.
45
Related CVEs
by mentions- Untrusted plugin search path in GNU libextractor
- Stack Overflow DoS in GNU libextractor StarOffice Parser (pre-1.15)
- Arbitrary Code Execution via read-symbol-shorthands in GNU Emacs 28.1–31.1
Appears with
- GNUvendor · 5
- libextractorproduct · 2
- telnetdproduct · 1
- muslproduct · 1
- GNU Inetutilsproduct · 1
- GNU Emacsproduct · 1
- Bashproduct · 1
- LLVMorganization · 1
- glibcproduct · 1
- Clangproduct · 1
- GNU libextractorproduct · 1
- rlogindproduct · 1
- Savaneproduct · 1
- FSFvendor · 1
- libinetutilsproduct · 1
- rloginproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.