Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 31 Aug 2008 01:46:25 +0200
From: Nico Golde <>
Subject: Re: CVE Request (gpicview)

Hi Jan,
* Jan Lieskovsky <> [2008-08-25 13:06]:
>   could you please allocate a CVE id for the following
> three gpicview issues:
> 1,
> Possible symlink attack via the temporary created "/tmp/rot.jpg" 
> file used for image rotation.
Same piece of code main-win.c doesn't look too trustworthy 
to me either:

    690     int error = jpegtran (filename, "/tmp/rot.jpg" , code);
    691     if(error)
    692         return error;
    694     //now copy /tmp/rot.jpg back to the original file
    695     char command[strlen(filename)+50]; //this should not generate buffer owerflow
    696     // MS: didn't know, how to make it better, maybe an own copy routine
    697     sprintf(command,"cp /tmp/rot.jpg \"%s\"",filename);
    698     system(command);

Anyone played with crafted file names?

Nico Golde - - - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ