Date: Tue, 26 Aug 2008 10:19:17 -0400 (EDT) From: "Steven M. Christey" <coley@...us.mitre.org> To: oss-security@...ts.openwall.com cc: coley@...re.org Subject: Re: CVE Request (gpicview) Jan, Are there common usage scenarios under which gpicview would receive the filename to create from some external source, say, as a web browser plugin? I'm asking because the missing "ask_before_save" issues only seem like non-security bugs - the user messing him/herself up - unless the target file can be influenced by an external attacker. > http://sourceforge.net/tracker/index.php?func=detail&aid=2019481&group_id=180858&atid=894869 > > Possible symlink attack via the temporary created "/tmp/rot.jpg" > file used for image rotation. Use CVE-2008-3791 > 2, > > http://sourceforge.net/tracker/index.php?func=detail&aid=2019485&group_id=180858&atid=894869 > > By presence of the LIBJPEG library we could without confirmation rewrite > the by the symlink targeted JPEG filesystem file. > > 3, > > http://sourceforge.net/tracker/index.php?func=detail&aid=2019492&group_id=180858&atid=894869 > > Consequences: Bad enough, just think about them in context of the two > previously mentioned issues. These two might need a second CVE depending on the influence over the file that "ask_before_save" would ask about. - Steve
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ