Date: Tue, 17 Sep 2013 16:57:40 +0200 From: Salvatore Bonaccorso <carnil@...ian.org> To: oss-security@...ts.openwall.com Cc: luciano@...ian.org Subject: Re: CVE request: davfs2 - Unsecure use of system() Hi Kurt, hi Luciano, On Tue, Sep 17, 2013 at 10:13:40AM +0200, Luciano Bello wrote: > Hi, > A security vulnerability have been reported in davfs2 > http://bugs.debian.org/723034 > > Please, assign a CVE id. As additional reference for this CVE request. The Debian Bugreport also contains the proposed diffs to apply to 1.4.6 and 1.4.7. But here are also upstream references. Upstream Bugreport: http://savannah.nongnu.org/bugs/?40034 Patches: 1.4.6: http://savannah.nongnu.org/bugs/download.php?file_id=29141 1.4.7: http://savannah.nongnu.org/bugs/download.php?file_id=29142 Regards, Salvatore
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.