control: reaffect -2 glibc-doc


Please document the implication of system.3 and popen.3, particularly
argument injection.

Please get inspiration from ENV33-C. Do not call system()

Sugest to use execvp and please provide example of secure alternative
for both API

Note that escaping argument is not portable particularly if argument
include control char for a POSIX shell.

https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=87152177



Use of the system() function can result in exploitable
vulnerabilities, in the worst case allowing execution of arbitrary
system commands. Situations in which calls to system() have high risk
include the following:

When passing an unsanitized or improperly sanitized command string
originating from a tainted source
If a command is specified without a path name and the command
processor path name resolution mechanism is accessible to an attacker
If a relative path to an executable is specified and control over the
current working directory is accessible to an attacker
If the specified executable program can be spoofed by an attacker

control: assign -1 glibc-doc

control: reassign -1 glibc-doc-reference
control: severity -1 normal

This manual is non-free, so it's clearly not glibc-doc, but
glibc-doc-reference. Please check the content of packages before
reporting bug, also please avoid abusing severity even if you are upset
by the issue. Patches are welcome.