ECHO-a40f-fcbc-6816
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-a40f-fcbc-6816.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-a40f-fcbc-6816
- Upstream
- CVE-2026-102474
- Withdrawn
- 2026-10-04T13:45:03Z
- Published
- 2026-09-30T19:04:58Z
- Modified
- 2026-10-04T14:15:06Z
- Summary
- Out-of-bounds write of one or two bytes when the printf builtin (and echo %b) converts a \u or \U Unicode escape into a multi-byte sequence. dash 0.5.12 has no \u or \U escapes. conv_escape() in src/bltin/printf.c handles only \\ \a \b \f \n \r \t \v and octal escapes; Debian's patch 0008-Support-e-in-echo-and-printf-builtins adds \e and nothing else. The Unicode-escape conversion arrived with upstream's "dollar single quote" work and was first released in dash 0.5.13. Trixie ships 0.5.12-12. MUST re-evaluate if trixie moves dash to 0.5.13 or later.
- Details
- References