Package: localepurge Version: 0.6.2+nmu1 Severity: important Tags: security
Hi Niels, the maintainer scripts of localepurge contain a funny tmp file vulnerability: $ grep tempfile -r . ./debian/postrm: DEBREINSTALL="$(tempfile).$$" ./debian/localepurge.config:TEMPFILE=$(tempfile).$$ ./debian/localepurge.config:LOCALEGEN=$(tempfile).locale.gen $ All of them are doing it wrong. They create a secure tempfile, but don't use it and instead generate a (now) predictable(!) name without opening it in a safe (O_CREAT) way. Helmut -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
