Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 25 Aug 2008 12:45:57 +0200
From: Jan Lieskovsky <>
Subject: CVE Request (gpicview)

Hello Steve,

  could you please allocate a CVE id for the following
three gpicview issues:


Possible symlink attack via the temporary created "/tmp/rot.jpg" 
file used for image rotation.


Related part of the code (the check for previous same filename file
existence is done only in the 'main_win_save' function):

            main_win_show_error(mw, "Save failed! Check permissions.");
    } else
        main_win_save( mw, file_name, type, pref.ask_before_save ); 
By presence of the LIBJPEG library we could without confirmation rewrite
the by the symlink targeted JPEG filesystem file.


Related part of the code:

void on_rotate_clockwise( GtkWidget* btn, MainWin* mw )
    rotate_image( mw, GDK_PIXBUF_ROTATE_CLOCKWISE );
    mw->rotation_angle += 90;
        pref.ask_before_save = FALSE;
        pref.ask_before_save = TRUE;

Consequences: Bad enough, just think about them in context of the two
previously mentioned issues.

Public mention of these issues:

Thank you in advance!

Kind regards
Jan iankko Lieskovsky
RH Security Resposne Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.