Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 12 Feb 2014 11:16:03 -0500 (EST)
From: cve-assign@...re.org
To: jwilk@...ian.org
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: [notification] CVE-2013-6888: uscan: remote code execution

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> untarring files to a direct subdirectory of /tmp (at least without
> --keep-old-files) is a vulnerability, although admittedly with very
> low severity. If the tarball contained a "." file, then tar would
> change permissions of the destination directory

Use CVE-2013-7325.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJS+527AAoJEKllVAevmvmsm2AIAI2p//1rhtqKktDuW8v6q9li
yESYOumwFjqyWm2yf/NUrtXjPB9kWBIApyy/vdEkC9MFn3B3WdB1MY59mb8hGymP
hsZ52QAg8yShbXBmL1ewAuVi70/hDEoGuX7RKEv5fqTyDfZb3QoKgHF6MGXMF+rJ
z8NeU8LnAqSk9ooglgEFjK66NmJhovNFd9KqGTsAmWPPkJtVjM7w9jGgkFwHk8u6
CCHn2NTisfLD7ceN408EfPMY1JGWaMuBRSODhYRGIEe4m+OKRHWNroXPlwyqX90Y
MlM7u7QpNWU/PHlaokrWT2TmeWqFEhnu7L3sjPytlCRSV/AHHtJlCScWek8Yio8=
=MVot
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.