Re: About the security issues affecting man-db in Squeeze
On Wed, Dec 16, 2015 at 10:43:30PM +0100, Raphael Hertzog wrote:
> the Debian LTS team recently reviewed the security issue(s) affecting your
> package in Squeeze:
> https://security-tracker.debian.org/tracker/CVE-2015-1336
>
> We decided that we would not prepare a squeeze security update because
> I don't see how this could be exploited by anyone... an unprivileged user
> should first find a way to run as user man.
I haven't worked out a proper fix for this at all upstream yet, though
with any luck I'll find some time over the Christmas holidays. As you
say it doesn't appear urgent. I'm not at all promising that a fix will
be sanely backportable, though; it is likely to take considerable
refactoring work.
--
Colin Watson [cjwatson@debian.org]
Reply to: