Posted at debian.org: "Byrial Jensen found a nasty problem in slrn (a threaded news reader). The notice on slrn-announce describes it as follows:
When trying to decode binaries, the built-in code executes any shell scripts the article might contain, apparently assuming they would be
some kind of self-extracting archive.
This problem has been fixed in version 0.9.6.2-9potato2 by removing this feature."