Package: rawstudio
Version: 2.0-1.1
Severity: important
Dear Maintainer,
The function "rs_filter_graph" located in file ./librawstudio/rs-filter.c
contains the following code:
g_string_append_printf(str, "}\n");
g_file_set_contents("/tmp/rs-filter-graph", str->str, str->len, NULL);
ignore = system("dot -Tpng >/tmp/rs-filter-graph.png
</tmp/rs-filter-graph");
ignore = system("gnome-open /tmp/rs-filter-graph.png");
This code makes insecure use of two temporary files:
/tmp/rs-filter-graph.png
/tmp/rs-filter-graph
This allows the truncation of arbitrary files which are owned by the user
running
rawstudio - for example:
ln -s ~/.important /tmp/rs-filter-graph
ln -s /etc/shadow /tmp/rs-filter-graph.png
This function should be updated to use a secure temporary file.
Steve
--
https://dns-api.com/
-- System Information:
Debian Release: 7.6
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 3.14-0.bpo.1-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF8, LC_CTYPE=en_US.UTF8 (charmap=UTF-8) (ignored: LC_ALL
set to en_US.UTF8)
Shell: /bin/sh linked to /bin/dash
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
