Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 18 Dec 2014 21:59:21 +0100
From: Martin Carpenter <>
Subject: Re: Running Java across a privilege boundry

On Thu, 2014-12-18 at 21:43 +0300, Alexander Cherepanov wrote:
> Relative paths is not the only problem. /tmp is even worse:

Nice, thanks. Revised:

Libraries that define RPATH or RUNPATH should ensure that this does not
contain relative paths or paths that traverse insecure directories
(eg /tmp or /var/tmp). This is to prevent an executable from loading a
library from an untrusted location. (This should include the corner
cases whereby the path list starts or ends with a colon, or includes two
consecutive colons).

("insecure directories" is intentionally broad (not just "world
writable"). Clarify?).

I'll file a bug against debian-policy in ~24h unless there are further

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.