Your message dated Mon, 07 Feb 2005 11:32:20 -0500
with message-id <[EMAIL PROTECTED]>
and subject line Bug#293976: fixed in gv 1:3.6.1-7
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 7 Feb 2005 09:30:08 +0000
>From [EMAIL PROTECTED] Mon Feb 07 01:30:08 2005
Return-path: <[EMAIL PROTECTED]>
Received: from cave.achos.com [213.240.187.82]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1Cy5Db-00040l-00; Mon, 07 Feb 2005 01:30:07 -0800
Received: by cave.achos.com (Postfix, from userid 1111)
id 2B3356B067; Mon, 7 Feb 2005 10:30:02 +0100 (CET)
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Tobias Stefan Richter <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: gv: does not quote or handle filenames given to the shell when printing
X-Mailer: reportbug 3.2
Date: Mon, 07 Feb 2005 10:30:01 +0100
Message-Id: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Package: gv
Version: 1:3.6.1-5
Severity: grave
Justification: user security hole
gv does not handle filenames correctly.
When trying to print a file with a space in it, I get:
$ gv 24\ stundenprotokoll.ps
Warning - Cannot open file '24', No such file or directory
Warning - Cannot open file 'stundenprotokoll.ps', No such file or directory
lp: nothing to print
Warning - Cannot open file '/home/tsr/gv_42073222_1_24', No such file or
directory
Warning - Cannot open file 'stundenprotokoll.ps.tmp', No such file or directory
lp: nothing to print
$
The first message is from 'Print All' the second is a 'Print Marked'.
Using specially crafted filenames it is also possible to launch
arbitrary programs under the invoking user's id. This is a security risk.
-- System Information:
Debian Release: 3.1
APT prefers testing
APT policy: (500, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.4.26
Locale: LANG=en_US.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Versions of packages gv depends on:
ii gs 8.01-5 Transitional package
ii gs-gpl [gs] 8.01-5 The GPL Ghostscript PostScript int
ii libc6 2.3.2.ds1-20 GNU C Library: Shared libraries an
ii libice6 4.3.0.dfsg.1-10 Inter-Client Exchange library
ii libsm6 4.3.0.dfsg.1-10 X Window System Session Management
ii libx11-6 4.3.0.dfsg.1-10 X Window System protocol client li
ii libxext6 4.3.0.dfsg.1-10 X Window System miscellaneous exte
ii libxmu6 4.3.0.dfsg.1-10 X Window System miscellaneous util
ii libxpm4 4.3.0.dfsg.1-10 X pixmap library
ii libxt6 4.3.0.dfsg.1-10 X Toolkit Intrinsics
ii xaw3dg 1.5+E-8 Xaw3d widget set
ii xlibs 4.3.0.dfsg.1-10 X Keyboard Extension (XKB) configu
-- no debconf information
---------------------------------------
Received: (at 293976-close) by bugs.debian.org; 7 Feb 2005 16:38:17 +0000
>From [EMAIL PROTECTED] Mon Feb 07 08:38:17 2005
Return-path: <[EMAIL PROTECTED]>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CyBtx-0002h5-00; Mon, 07 Feb 2005 08:38:17 -0800
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1CyBoC-0007TX-00; Mon, 07 Feb 2005 11:32:20 -0500
From: [EMAIL PROTECTED] (Martin A. Godisch)
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.55 $
Subject: Bug#293976: fixed in gv 1:3.6.1-7
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Mon, 07 Feb 2005 11:32:20 -0500
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Source: gv
Source-Version: 1:3.6.1-7
We believe that the bug you reported is fixed in the latest version of
gv, which is due to be installed in the Debian FTP archive:
gv_3.6.1-7.diff.gz
to pool/main/g/gv/gv_3.6.1-7.diff.gz
gv_3.6.1-7.dsc
to pool/main/g/gv/gv_3.6.1-7.dsc
gv_3.6.1-7_i386.deb
to pool/main/g/gv/gv_3.6.1-7_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Martin A. Godisch <[EMAIL PROTECTED]> (supplier of updated gv package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Mon, 07 Feb 2005 17:20:25 +0100
Source: gv
Binary: gv
Architecture: source i386
Version: 1:3.6.1-7
Distribution: unstable
Urgency: high
Maintainer: Martin A. Godisch <[EMAIL PROTECTED]>
Changed-By: Martin A. Godisch <[EMAIL PROTECTED]>
Description:
gv - PostScript and PDF viewer for X
Closes: 293976
Changes:
gv (1:3.6.1-7) unstable; urgency=high
.
* Re-applied lost 3.5.8 patch (filename quotation), closes: #293976.
* Added DEB_BUILD_OPTIONS="debug".
Files:
a8cba43cc8842896a744a1020d930685 548 text optional gv_3.6.1-7.dsc
16d9f13dbef10521e7d7b84ec0a54c44 29881 text optional gv_3.6.1-7.diff.gz
809c42ab0705a578e53b3b293745c4cf 160134 text optional gv_3.6.1-7_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFCB5V/mpGCHWjc1gYRAik0AKDWN1j25E4+rIAnttIjJ6Fg4K+9LQCfd3K5
ghxW5IWsIavwyc6P1q1DgL0=
=u80r
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
