Date: Tue, 22 Jul 2014 06:59:04 +0200 From: Salvatore Bonaccorso <carnil@...ian.org> To: OSS Security Mailinglist <oss-security@...ts.openwall.com> Cc: Michael Sweet <msweet@...le.com>, odyx@...ian.org, CVE Assignments MITRE <cve-assign@...re.org> Subject: CVE Request: cups: Incomplete fix for CVE-2014-3537 Hi CVE-2014-3537 was allocated for http://www.cups.org/str.php?L4450 (Insufficient checking leads to privilege escalation). The intention in the fix was to dissalow symlinks. With the fix applied fo CVE-2014-3537 this is still possible in some cases (where language is null), see https://cups.org/str.php?L4455 Additionally Michael Sweet wrote: > Yes, it looks like this needs to be an lstat as well, and we should > probably add similar protections to the directory index files (which > are also using stat). Could a CVE be assigned to identify this? (Question: one CVE should be enough for the additional fix for all the missing remaining lstat?). Regards, Salvatore
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.