oss-security - Inkscape reads .eps files from /tmp instead of the current directory

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20121229103143.GA3201@elende>
Date: Sat, 29 Dec 2012 11:31:43 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Cc: team@...urity.debian.org
Subject: Inkscape reads .eps files from /tmp instead of the current
 directory

Hi

Going trough some bugreports in Debian I noticed [1], [2] I haven't
found a CVE for "Inkscape reads .eps files from /tmp instead of the
current directory".

If one has file foo.eps in current directory, and /tmp/foo.eps is
present

 $ inkscape foo.eps

opens the copy in /tmp/foo.eps

Does this warrants a CVE? If so could you assign one?

 [1]: http://bugs.debian.org/654341
 [2]: https://bugs.launchpad.net/inkscape/+bug/911146

Regards,
Salvatore

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.