[Secure-testing-team] Bug#767227: lsyncd: Crash and/or code execution on `, $, " in file names

[creshal]

Package: lsyncd
Version: 2.0.7-3
Severity: important
Tags: security patch

cf. upstream bug report and fix at
 https://github.com/axkibe/lsyncd/issues/220

This is the same patch backported to the lsyncd version in stable.

-- System Information:
Debian Release: 7.6
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages lsyncd depends on:
ii  libc6        2.13-38+deb7u4
ii  liblua5.1-0  5.1.5-4+deb7u1
ii  lua5.1       5.1.5-4+deb7u1
ii  rsync        3.0.9-4

lsyncd recommends no packages.

lsyncd suggests no packages.

-- no debconf information
-------------- next part --------------
A non-text attachment was scrubbed...
Name: fix-shell-escapes.patch
Type: text/x-diff
Size: 1286 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20141029/f282167c/attachment.patch>