puggy Bodhisattva
Joined: 28 Feb 2003 Posts: 1992 Location: Oxford, UK
|
Posted: Sat Aug 16, 2003 11:07 am Post subject: [gentoo-announce] GLSA: semi (200308-02) |
|
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200308-02
- - - ---------------------------------------------------------------------
PACKAGE : semi
SUMMARY : insecure temporary files creation
DATE : 2003-08-14 19:30 UTC
EXPLOIT : local
VERSIONS AFFECTED : <semi-1.14.5-r1
FIXED VERSION : >=semi-1.14.5-r1
CVE : CAN-2003-0440
- - - ---------------------------------------------------------------------
quote from CVE:
"The (1) semi MIME library 1.14.5 and earlier, and (2) wemi 1.14.0 and
possibly other versions, allows local users to overwrite arbitrary files
via a symlink attack on temporary files."
SOLUTION
It is recommended that all Gentoo Linux users who are running
app-emacs/semi upgrade to semi-1.14.5-r1 as follows
emerge sync
emerge semi
emerge clean
- - - ---------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at http://dev.gentoo.org/~aliz
usata@gentoo.org
- - - ---------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
iD8DBQE/O+NVfT7nyhUpoZMRAlo0AJ0ZwAWeNbss87RYJ5UaSvHXkF3n7wCfbZTw
eDaHCxhEc1WGSEoQpcL+/J8=
=ThD4
-----END PGP SIGNATURE----- _________________ Where there's open source , there's a way. |
|