[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20090206182049.4b0dd9a4@redhat.com>
Date: Fri, 6 Feb 2009 18:20:49 +0100
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: jhead
On Thu, 27 Nov 2008 00:21:54 +0100 Robert Buchholz <rbu@...too.org>
wrote:
> These two issues have been resolved in the current
> "jhead-latest.tar.gz" distributed on the upstream site. Both Ubuntu
> and Debian have renamed one version of this file to be "2.85" whereas
> upstream has not yet released any 2.85 version. Upstream stated that
> they will release a 2.85 not before next year, so anyone who has this
> issue open can either extract patches, package the snapshot or wait.
Looks like -latest tarball was updated again and now mentions 2.86
inside. In that, usage of mkstemp was replaced with mktemp (previous
version failed to close file descriptors opened by mkstemp, probably
causing issues when trying to use command on large pile of images at
once). Those the temp file seem to be created user-specified
destination directory, probably not too likely to be /tmp (and hence
prone to races).
Anyway, can anyone help me understand what was CVE-2008-4639 assigned
to? I tried looking at the diff between 2.7 and 2.84 and fail to see
any relevant change...
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
