Date: Fri, 6 Feb 2009 18:20:49 +0100 From: Tomas Hoger <thoger@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: CVE request: jhead On Thu, 27 Nov 2008 00:21:54 +0100 Robert Buchholz <rbu@...too.org> wrote: > These two issues have been resolved in the current > "jhead-latest.tar.gz" distributed on the upstream site. Both Ubuntu > and Debian have renamed one version of this file to be "2.85" whereas > upstream has not yet released any 2.85 version. Upstream stated that > they will release a 2.85 not before next year, so anyone who has this > issue open can either extract patches, package the snapshot or wait. Looks like -latest tarball was updated again and now mentions 2.86 inside. In that, usage of mkstemp was replaced with mktemp (previous version failed to close file descriptors opened by mkstemp, probably causing issues when trying to use command on large pile of images at once). Those the temp file seem to be created user-specified destination directory, probably not too likely to be /tmp (and hence prone to races). Anyway, can anyone help me understand what was CVE-2008-4639 assigned to? I tried looking at the diff between 2.7 and 2.84 and fail to see any relevant change... -- Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.