Bug#433900: gocr: call to shell with unquoted user-supplied filenames

[Cosimo Alfarano]

The problem is still there even in version 0.45 as in src/pnm.c line  
157:

        /* potential security vulnerability, if name contains tricks */
        /* example: gunzip -c dummy | rm -rf * */
        fp = popen(buf, "r");
the upstream is aware of it.

C.
--
Cosimo Alfarano <[EMAIL PROTECTED]>







--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]