/[man-db]/man-db/docs/NEWS
ViewVC logotype

Diff of /man-db/docs/NEWS

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.31 by cjwatson, Mon Apr 28 08:07:42 2003 UTC revision 1.32 by cjwatson, Sat Aug 2 18:33:08 2003 UTC
# Line 6  Major changes since man-db 2.4.1: Line 6  Major changes since man-db 2.4.1:
6          Fixes:          Fixes:
7          ------          ------
8    
9            o SECURITY: Fix a number of buffer overruns in configuration file
10              handling, ultimate source location, and MANPATH processing. This
11              is CVE CAN-2003-0620.
12    
13            o SECURITY: Restrict the use of the DEFINE directive in ~/.manpath
14              to code running with dropped privilege. Previously, the
15              'compressor' variable could be used to run arbitrary code with
16              raised privilege. This is CVE CAN-2003-0645.
17    
18          o Make sure to initialize mandata structures to zero. The uses of          o Make sure to initialize mandata structures to zero. The uses of
19            uninitialized memory resulting from this had been leading to random            uninitialized memory resulting from this had been leading to
20            segfaults.            random segfaults.
21    
22          o Drop privileges in order to be able to read pages in          o Drop privileges in order to be able to read pages in
23            non-world-readable user manpaths while setuid.            non-world-readable user manpaths while setuid.

Legend:
Removed from v.1.31  
changed lines
  Added in v.1.32

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26