diff options
| author |   Ulrich Müller <ulm@gentoo.org> | 2008-04-11 14:00:09 +0000 |
|---|---|---|
| committer | Ulrich Müller <ulm@gentoo.org> | 2008-04-11 14:00:09 +0000 |
| commit | f4e5d69f1b6a954bcde78b8b365e85d0933e870f (patch) | |
| tree | def5479d972d7807a6357108f9231283ef80b491 /app-editors/emacs/files | |
| parent | Latest release, thanks to dberkholz for pointing it out. (diff) | |
| download | gentoo-2-f4e5d69f1b6a954bcde78b8b365e85d0933e870f.tar.gz gentoo-2-f4e5d69f1b6a954bcde78b8b365e85d0933e870f.tar.bz2 gentoo-2-f4e5d69f1b6a954bcde78b8b365e85d0933e870f.zip | |
Fix vcdiff insecure temporary file creation, CVE-2008-1694, security bug 216880.
(Portage version: 2.1.5_rc2, RepoMan options: --force)
Diffstat (limited to 'app-editors/emacs/files')
| -rw-r--r-- | app-editors/emacs/files/emacs-22.1-vcdiff-tmp-race.patch | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/app-editors/emacs/files/emacs-22.1-vcdiff-tmp-race.patch b/app-editors/emacs/files/emacs-22.1-vcdiff-tmp-race.patch new file mode 100644 index 000000000000..7f59d6afeeac --- /dev/null +++ b/app-editors/emacs/files/emacs-22.1-vcdiff-tmp-race.patch @@ -0,0 +1,25 @@ +Steve Grubb of Red Hat discovered that vcdiff script as shipped with Emacs +(confirmed in versions 20.7 to 22.1.50) uses temporary files insecurely, +which makes it possible for local attacker to conduct a symlink attack and +make the victim overwrite arbitrary file. + +diff -ur emacs-21.4.orig/lib-src/vcdiff emacs-21.4/lib-src/vcdiff +--- emacs-21.4.orig/lib-src/vcdiff 2006-09-28 12:07:51.000000000 -0400 ++++ emacs-21.4/lib-src/vcdiff 2006-09-28 15:58:53.000000000 -0400 +@@ -86,14 +86,14 @@ + case $f in + s.* | */s.*) + if +- rev1=/tmp/geta$$ ++ rev1=`mktemp /tmp/geta.XXXXXXXX` + get -s -p -k $sid1 "$f" > $rev1 && + case $sid2 in + '') + workfile=`expr " /$f" : '.*/s.\(.*\)'` + ;; + *) +- rev2=/tmp/getb$$ ++ rev2=`mktemp /tmp/getb.XXXXXXXX` + get -s -p -k $sid2 "$f" > $rev2 + workfile=$rev2 + esac |