Bug#598308: vdr-dbg: CVE-2010-3387: insecure library loading

2010-10-02 Thread Tobias Grimm
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Julien Cristau wrote: > LD_LIBRARY_PATH is colon-separated, though, not semicolon-separated, so > LD_LIBRARY_PATH="/usr/lib/debug;$LD_LIBRARY_PATH" is broken, but not a > security issue. Besides, this looks like a debugging utility so I don't > think

Bug#598308: vdr-dbg: CVE-2010-3387: insecure library loading

2010-09-28 Thread Julien Cristau
On Tue, Sep 28, 2010 at 04:23:26 +, Raphael Geissert wrote: > Package: vdr-dbg > Version: 1.6.0-18 > Severity: grave > Tags: security > User: t...@security.debian.org > Usertags: ldpath > > Hello, > > During a review of the Debian archive, I've found your package to > contain a script that c

Bug#598308: vdr-dbg: CVE-2010-3387: insecure library loading

2010-09-27 Thread Raphael Geissert
Package: vdr-dbg Version: 1.6.0-18 Severity: grave Tags: security User: t...@security.debian.org Usertags: ldpath Hello, During a review of the Debian archive, I've found your package to contain a script that can be abused by an attacker to execute arbitrary code. The vulnerability is introduced