Issued:

2012-06-20

Updated:

2012-06-20

RHBA-2012:0952 - ksh bug fix update

Synopsis

ksh bug fix update

Type/Severity

Bug Fix Advisory (none)

Topic

Updated ksh packages that fix multiple bugs are now available for Red Hat Enterprise Linux 6.

Description

KSH-93 is the most recent version of the KornShell by David Korn of AT&T Bell Laboratories. KornShell is a shell programming language which is also compatible with sh, the original Bourne Shell.

This update fixes the following bugs:

• Previously, ksh sometimes did not restore terminal settings after read timeout when operating in a multibyte environment. This could cause the terminal to no longer echo input characters. This updates applies a patch ensuring that the terminal is restored properly after the timeout and the user's input is now echoed as expected. (BZ#577223)

• When exiting a subshell after a command substitution, ksh could prematurely exit without any error message. With this update, ksh no longer terminates under these circumstances and all subsequent commands are processed correctly. (BZ#742930)

• Previously, ksh did not prevent modifications of variables of the read-only type. As a consequence, ksh terminated unexpectedly with a segmentation fault when such a variable was modified. With this update, modification of read-only variables are not allowed, and ksh prints an error message in this scenario. (BZ#743840)

• Previously, ksh did not close certain file descriptors prior to execution. This could lead to a file descriptor leak, and certain applications could consequently report error messages. With this update, file descriptors are marked to be closed on execution if appropriate, so file descriptor leaks no longer occur. (BZ#781498)

• In certain cases, ksh unnecessarily called the vfork() function. An extra process was created, and it could be difficult to determine how many instances of a script were running. A patch has been applied to address this problem, and extra processes are no longer created if not required. (BZ#781976)

• Previously, ksh could incorrectly seek in the input stream. This could lead to data corruption in the here-document section of a script. This update corrects the seek behavior, so the data no longer gets corrupted in this scenario. (BZ#786787)

• Previously, ksh did not allocate the correct amount of memory for its data structures containing information about file descriptors. When running a task that used file descriptors extensively, ksh terminated unexpectedly with a segmentation fault. With this update, the proper amount of memory is allocated, and ksh no longer crashes if file descriptors are used extensively. (BZ#798868)

• Previously, ksh did not expand the tilde (~) character properly. For example, characters in the tilde prefix were not treated as a login name but as a part of the path and the "No such file or directory" message was displayed. The underlying source code has been modified and tilde expansion now works as expected in such a scenario. (BZ#800684)

All users of ksh are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258

Affected Products

Updated Packages

• ksh-debuginfo-20100621-16.el6.x86_64.rpm
• ksh-debuginfo-20100621-16.el6.i686.rpm
• ksh-debuginfo-20100621-16.el6.s390x.rpm
• ksh-20100621-16.el6.i686.rpm
• ksh-20100621-16.el6.s390x.rpm
• ksh-debuginfo-20100621-16.el6.ppc64.rpm
• ksh-20100621-16.el6.src.rpm
• ksh-20100621-16.el6.x86_64.rpm
• ksh-20100621-16.el6.ppc64.rpm

Fixes

• This content is not included.BZ - 743840
• This content is not included.BZ - 781498

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.