Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 31 Aug 2008 01:46:25 +0200
From: Nico Golde <>
Subject: Re: CVE Request (gpicview)

Hi Jan,
* Jan Lieskovsky <> [2008-08-25 13:06]:
>   could you please allocate a CVE id for the following
> three gpicview issues:
> 1,
> Possible symlink attack via the temporary created "/tmp/rot.jpg" 
> file used for image rotation.
Same piece of code main-win.c doesn't look too trustworthy 
to me either:

    690     int error = jpegtran (filename, "/tmp/rot.jpg" , code);
    691     if(error)
    692         return error;
    694     //now copy /tmp/rot.jpg back to the original file
    695     char command[strlen(filename)+50]; //this should not generate buffer owerflow
    696     // MS: didn't know, how to make it better, maybe an own copy routine
    697     sprintf(command,"cp /tmp/rot.jpg \"%s\"",filename);
    698     system(command);

Anyone played with crafted file names?

Nico Golde - - - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.