GNU gv - Bugs: bug #30037, insecure creation of temporary file
You are not allowed to post comments on this tracker with your current authentication level.
bug #30037: insecure creation of temporary file
Submitter: | Ludwig Nussel <lnussel> | ||
Submitted: | Wed 02 Jun 2010 01:17:48 PM UTC | ||
Category: | Sources configuration | Severity: | 6 - Security |
Item Group: | None | Status: | Fixed |
Privacy: | Public | Assigned to: | None |
Open/Closed: | Closed | Release: | None |
Thu 03 Jun 2010 04:29:27 PM UTC, comment #3: |
Markus Steinborn <msteinbo> |
Wed 02 Jun 2010 01:32:03 PM UTC, comment #2: Thank you for the bug report. I'm already working on this problem - see the debian bug report you linked and also see the public bug-gv archives.
|
Markus Steinborn <msteinbo> |
Wed 02 Jun 2010 01:26:13 PM UTC, comment #1: The issue got CVE-2010-2056 assigned |
Ludwig Nussel <lnussel> |
Wed 02 Jun 2010 01:17:48 PM UTC, original submission:
when viewing pdf files gv instructs gs to write into a file in /tmp. gv does not make sure that the file gets created in a secure way though. gv should either not use /tmp for the storage or use mkstemp to actually create the file before calling gs. The issue was originally reported here:
|
Ludwig Nussel <lnussel> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 5 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2010-06-03 | msteinbo | Severity | 3 - Normal | 6 - Security | |
Status | None | Fixed | |||
Open/Closed | Open | Closed | |||
2010-06-02 | msteinbo | Category | PDF rendering | Sources configuration | |
2010-06-02 | lnussel | Carbon-Copy | - | Added wfink |
Powered by Savane 3.13-758e.
Corresponding source code
Fixed in prerelase 3.6.91.