Date: Tue, 26 Aug 2008 10:19:17 -0400 (EDT) From: "Steven M. Christey" <coley@...us.mitre.org> To: oss-security@...ts.openwall.com cc: coley@...re.org Subject: Re: CVE Request (gpicview) Jan, Are there common usage scenarios under which gpicview would receive the filename to create from some external source, say, as a web browser plugin? I'm asking because the missing "ask_before_save" issues only seem like non-security bugs - the user messing him/herself up - unless the target file can be influenced by an external attacker. > http://sourceforge.net/tracker/index.php?func=detail&aid=2019481&group_id=180858&atid=894869 > > Possible symlink attack via the temporary created "/tmp/rot.jpg" > file used for image rotation. Use CVE-2008-3791 > 2, > > http://sourceforge.net/tracker/index.php?func=detail&aid=2019485&group_id=180858&atid=894869 > > By presence of the LIBJPEG library we could without confirmation rewrite > the by the symlink targeted JPEG filesystem file. > > 3, > > http://sourceforge.net/tracker/index.php?func=detail&aid=2019492&group_id=180858&atid=894869 > > Consequences: Bad enough, just think about them in context of the two > previously mentioned issues. These two might need a second CVE depending on the influence over the file that "ask_before_save" would ask about. - Steve
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.