Rootpipe Reborn (Part I)
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
CVE-2019-8513 is a root command injection flaw in macOS's TimeMachine diagnostic tool (tmdiagnose), affecting macOS 10.12 through 10.14.3 and patched in 10.14.4. Researcher CodeColorist found that tmdiagnose builds a shell command from disk volume names using awk, so a crafted disk image label containing a newline and shell substitution can…