Package: spamassassin Version: 3.3.2-5 Severity: grave Tags: security Justification: user security hole
Dear Maintainer, I get the following output from /etc/cron.daily/spamassassin: ------------------------------------------------------------- /etc/cron.daily/spamassassin: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: WARNING: Failed chmod(0666, /var/lib/spamassassin/compiled/5.014/3.003002/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so): Operation not permitted !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ------------------------------------------------------------ The script wants to set a shared library world writable. This is a security risk. -- System Information: Debian Release: 7.4 APT prefers stable APT policy: (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 3.2.0-4-amd64 (SMP w/1 CPU core) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages spamassassin depends on: ii adduser 3.113+nmu3 pn libarchive-tar-perl <none> ii libhtml-parser-perl 3.69-2 ii libnet-dns-perl 0.66-2+b2 ii libnetaddr-ip-perl 4.062+dfsg-1 ii libsocket6-perl 0.23-1+b2 ii libsys-hostname-long-perl 1.4-2 ii libwww-perl 6.04-1 ii perl 5.14.2-21+deb7u1 ii perl-modules [libio-zlib-perl] 5.14.2-21+deb7u1 Versions of packages spamassassin recommends: ii gcc 4:4.7.2-1 ii gnupg 1.4.12-7+deb7u3 ii libc6-dev 2.13-38+deb7u1 ii libio-socket-inet6-perl 2.69-2 ii libmail-spf-perl 2.8.0-1 ii make 3.81-8.2 ii perl [libsys-syslog-perl] 5.14.2-21+deb7u1 ii re2c 0.13.5-1 ii spamc 3.3.2-5 Versions of packages spamassassin suggests: pn libdbi-perl <none> ii libio-socket-ssl-perl 1.76-2 pn libmail-dkim-perl <none> pn libnet-ident-perl <none> ii perl [libcompress-zlib-perl] 5.14.2-21+deb7u1 ii pyzor 1:0.5.0-2 ii razor 1:2.85-4+b1 -- Configuration Files: /etc/default/spamassassin changed: ENABLED=1 OPTIONS="--create-prefs --max-children 5 --helper-home-dir" PIDFILE="/var/run/spamd.pid" CRON=1 /etc/spamassassin/v320.pre changed: loadplugin Mail::SpamAssassin::Plugin::Check loadplugin Mail::SpamAssassin::Plugin::HTTPSMismatch loadplugin Mail::SpamAssassin::Plugin::URIDetail loadplugin Mail::SpamAssassin::Plugin::Bayes loadplugin Mail::SpamAssassin::Plugin::BodyEval loadplugin Mail::SpamAssassin::Plugin::DNSEval loadplugin Mail::SpamAssassin::Plugin::HTMLEval loadplugin Mail::SpamAssassin::Plugin::HeaderEval loadplugin Mail::SpamAssassin::Plugin::MIMEEval loadplugin Mail::SpamAssassin::Plugin::RelayEval loadplugin Mail::SpamAssassin::Plugin::URIEval loadplugin Mail::SpamAssassin::Plugin::WLBLEval loadplugin Mail::SpamAssassin::Plugin::VBounce loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody loadplugin Mail::SpamAssassin::Plugin::ImageInfo -- no debconf information -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
