Bug#763780: apt-get: Insecure temporary changelog handling

2014-10-08 Thread Guillem Jover
Hi! On Wed, 2014-10-08 at 10:42:07 +0200, Michael Vogt wrote: > On Thu, Oct 02, 2014 at 06:29:45PM +0200, Guillem Jover wrote: > > Package: apt > > Version: 0.8.7 > > Severity: serious > > Tags: security patch > > Attached a patch fixing this. This affects all versions starting from > > the one i

Bug#763780: apt-get: Insecure temporary changelog handling

2014-10-08 Thread Michael Vogt
On Thu, Oct 02, 2014 at 06:29:45PM +0200, Guillem Jover wrote: > Package: apt > Version: 0.8.7 > Severity: serious > Tags: security patch Thanks for your bugreport and your patch! > I've found an instance of insecure temporary filenames handling. The > problem is that the code correctly creates

Bug#763780: apt-get: Insecure temporary changelog handling

2014-10-02 Thread Guillem Jover
Package: apt Version: 0.8.7 Severity: serious Tags: security patch Hi! I've found an instance of insecure temporary filenames handling. The problem is that the code correctly creates a temporary directory, but then uses that name as just a prefix for the created changelog filename, thus creating