Re: [xsawyerx@gmail.com: CVE-2016-1238: Important unsafe module load path flaw]

[Dominic Hargreaves <dom@earth.li>]

On Tue, Jul 26, 2016 at 12:17:42PM +0200, gregor herrmann wrote:
> On Mon, 25 Jul 2016 21:46:46 +0200, gregor herrmann wrote:
> 
> > On Mon, 25 Jul 2016 15:15:30 +0100, Dominic Hargreaves wrote:
> > > Please could team members look at the patches I've applied in the
> > > jessie-security branches of
> > > - libmodule-build-perl
> [..]
> > The former three are done by Salavatore (libmime*) and me (M::B).
> 
> For Module::Build there's an interesting comment at
> https://github.com/Perl-Toolchain-Gang/Module-Build/issues/69#issuecomment-23520
> 0181
> which leads into territory outside my knowledge/comfort zone.
> 
> Perl and security gurus, please take over :)

Thanks, I've commented.

Dominic.