Date: Tue, 12 Jan 2016 08:37:02 -0600 From: Jamie Strandboge <jamie@...onical.com> To: cve-assign@...re.org Cc: oss-security@...ts.openwall.com, security <security@...ntu.com> Subject: Re: CVE Request: click I forgot to CC cve-assign@...re.org on the initial request so bringing them in the loop now. On 01/11/2016 11:42 AM, Jamie Strandboge wrote: > > Hi MITRE, all, > > A vulnerability was discovered in the click package system: > https://launchpad.net/bugs/1506467 > http://www.ubuntu.com/usn/usn-2771-1/ > > It was fixed in 0.4.42 with: > https://code.launchpad.net/~cjwatson/click/audit-missing-dot-slash/+merge/274554 > > This is an input sanitization bug where click assumed leading paths were always > prefixed with './' which, for example, allows a crafted click to ship a '.click' > directory to manipulate the click install process. > > Can we get a CVE for this? > > Thanks! > -- Jamie Strandboge http://www.ubuntu.com/ [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ