Hi Sorry, here is the corrected debdiff for the libpar-packer-perl.
Regards Salvatore
diff -Nru libpar-packer-perl-1.006/debian/changelog libpar-packer-perl-1.006/debian/changelog --- libpar-packer-perl-1.006/debian/changelog 2010-06-28 18:17:16.000000000 +0200 +++ libpar-packer-perl-1.006/debian/changelog 2011-12-15 09:27:14.000000000 +0100 @@ -1,3 +1,15 @@ +libpar-packer-perl (1.006-1+squeeze1) stable; urgency=low + + * Team upload. + * Add create-safe-temporary-directories.patch patch. + Fixes CVE-2011-4114: PAR packed files are extracted to unsafe and + predictable temporary directories. (Closes: #650706) + * Bump (Build-)Depends on libpar-perl. + Bump the dependencies to libpar-perl (>= 1.000-1+squeeze1) as this + version contains the other half of the fix for CVE-2011-4114. + + -- Salvatore Bonaccorso <car...@debian.org> Tue, 13 Dec 2011 22:03:26 +0100 + libpar-packer-perl (1.006-1) unstable; urgency=low * New upstream release. diff -Nru libpar-packer-perl-1.006/debian/control libpar-packer-perl-1.006/debian/control --- libpar-packer-perl-1.006/debian/control 2010-06-28 18:13:58.000000000 +0200 +++ libpar-packer-perl-1.006/debian/control 2011-12-15 09:27:14.000000000 +0100 @@ -6,7 +6,7 @@ libgetopt-argvfile-perl (>= 1.07), libinline-perl, libmodule-scandeps-perl (>= 0.96), - libpar-perl (>= 1.000), + libpar-perl (>= 1.000-1+squeeze1), libperl-dev, libtest-pod-perl, perl (>= 5.10) | libio-compress-perl | libcompress-zlib-perl (>= 1.3) @@ -28,7 +28,7 @@ libgetopt-argvfile-perl (>= 1.07), libmodule-scandeps-perl (>= 0.96), libpar-dist-perl (>= 0.22), - libpar-perl (>= 1.000), + libpar-perl (>= 1.000-1+squeeze1), perl (>= 5.10) | libio-compress-perl | libcompress-zlib-perl (>= 1.3) Recommends: libtk-perl Description: utility for creating PAR archives and stand-alone executables diff -Nru libpar-packer-perl-1.006/debian/patches/create-safe-temporary-directories.patch libpar-packer-perl-1.006/debian/patches/create-safe-temporary-directories.patch --- libpar-packer-perl-1.006/debian/patches/create-safe-temporary-directories.patch 1970-01-01 01:00:00.000000000 +0100 +++ libpar-packer-perl-1.006/debian/patches/create-safe-temporary-directories.patch 2011-12-15 09:27:14.000000000 +0100 @@ -0,0 +1,67 @@ +Description: Create safe temporary directories + CVE-2011-4114: PAR packed files are extracted to unsafe and predictable + temporary directories. + . + - create parent of cache directory (i.e. /tmp/par-USER) with mode 0700 + - if it already exists, make sure that (and bail out if not) + - it's not a symlink + - it's mode 0700 + - it's owned by USER +Origin: upstream +Bug: https://rt.cpan.org/Public/Bug/Display.html?id=69560 +Bug-Debian: http://bugs.debian.org/650706 +Forwarded: not-needed +Author: Salvatore Bonaccorso <car...@debian.org> +Last-Update: 2011-12-13 + +--- a/myldr/mktmpdir.c ++++ b/myldr/mktmpdir.c +@@ -153,7 +153,38 @@ + stmpdir = malloc( stmp_len ); + stmpdir2 = malloc( stmp_len ); + sprintf(stmpdir2, "%s%s%s%s", tmpdir, dir_sep, subdirbuf_prefix, username); +- my_mkdir(stmpdir2, 0755); ++#ifdef WIN32 ++ _mkdir(stmpdir2); /* FIXME bail if error (other than EEXIST) */ ++#else ++ { ++ struct stat st; ++ ++ if (mkdir(stmpdir2, 0700) == -1 && errno != EEXIST) { ++ fprintf(stderr, "%s: creation of private subdirectory %s failed (errno=%i)\n", ++ argv[0], stmpdir2, errno); ++ return NULL; ++ } ++ ++ /* now check that: ++ * - stmpdir2 is a directory (and not a symlink) ++ * - stmpdir2 is owned by the user ++ * - stmpdir2 has mode 0700 ++ */ ++ if (lstat(stmpdir2, &st) == -1) { ++ fprintf(stderr, "%s: stat of private subdirectory %s failed (errno=%i)\n", ++ argv[0], stmpdir2, errno); ++ return NULL; ++ } ++ ++ if (!S_ISDIR(st.st_mode) ++ || st.st_uid != getuid() ++ || (st.st_mode & 0777) != 0700 ) { ++ fprintf(stderr, "%s: private subdirectory %s is unsafe\n", ++ argv[0], stmpdir2); ++ return NULL; ++ } ++ } ++#endif + + /* Doesn't really work - XXX */ + val = par_getenv( "PATH" ); +@@ -239,7 +270,7 @@ + a prior invocation crashed leaving garbage in a temp directory that + might interfere. */ + +- while (my_mkdir(stmpdir, 0755) == -1 && errno == EEXIST) { ++ while (my_mkdir(stmpdir, 0700) == -1 && errno == EEXIST) { + sprintf( + stmpdir, + "%s%stemp-%u-%u%s", diff -Nru libpar-packer-perl-1.006/debian/patches/series libpar-packer-perl-1.006/debian/patches/series --- libpar-packer-perl-1.006/debian/patches/series 2010-04-14 16:43:02.000000000 +0200 +++ libpar-packer-perl-1.006/debian/patches/series 2011-12-15 09:27:14.000000000 +0100 @@ -1,3 +1,4 @@ fix-pod-spelling.patch 01_manpage-ext.patch fix-with-new-par-name +create-safe-temporary-directories.patch
signature.asc
Description: Digital signature
