Bug#294896: marked as done (CAN-2005-0365: insecure temporary file creation in kdelibs 3.3.2)
Your message dated Sun, 13 Feb 2005 09:17:29 -0500
with message-id <E1D0KYz-0008RC-00@newraff.debian.org>
and subject line Bug#294832: fixed in kdelibs 4:3.3.2-2
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 12 Feb 2005 07:27:14 +0000
>From joey@infodrom.org Fri Feb 11 23:27:14 2005
Return-path: <joey@infodrom.org>
Received: from luonnotar.infodrom.org [195.124.48.78]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CzrgQ-0007ZS-00; Fri, 11 Feb 2005 23:27:14 -0800
Received: by luonnotar.infodrom.org (Postfix, from userid 10)
id 209F6366B73; Sat, 12 Feb 2005 08:27:18 +0100 (CET)
Received: at Infodrom Oldenburg (/\##/\ Smail-3.2.0.102 1998-Aug-2 #2)
from infodrom.org by finlandia.Infodrom.North.DE
via smail from stdin
id <m1CzrZh-000okpC@finlandia.Infodrom.North.DE>
for submit@bugs.debian.org; Sat, 12 Feb 2005 08:20:17 +0100 (CET)
Date: Sat, 12 Feb 2005 08:20:17 +0100
From: Martin Schulze <joey@infodrom.org>
To: submit@bugs.debian.org
Subject: CAN-2005-0365: insecure temporary file creation in kdelibs 3.3.2
Message-ID: <[🔎] 20050212072017.GB30534@finlandia.infodrom.north.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
User-Agent: Mutt/1.5.6+20040907i
Delivered-To: submit@bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Package: kdelibs
Version: 3.2.3-3.sarge.2 3.3.2-1
Severity: grave
Tags: security sarge sid patch
Please
. update the package in sid
. mention the CVE id from the subject in the changelog
. use priority=high
. you probably need to upload into testing-proposed-updates as well
Regards,
Joey
----- Forwarded message from Davide Madrisan <davide.madrisan@qilinux.it> -----
From: Davide Madrisan <davide.madrisan@qilinux.it>
Organization: QiNet s.r.l.
To: bugtraq@securityfocus.com
Subject: insecure temporary file creation in kdelibs 3.3.2
Date: Fri, 11 Feb 2005 09:16:38 +0100
The `dcopidlng' script in the KDE library package
(kdelibs-3.3.2/dcop/dcopidlng/dcopidlng)
creates temporary files in a unsecure manner.
This bug has been fixed in 32 minutes (!) by Stephan Kulow, the KDE team
leader. Here you can found the official patch:
http://bugs.kde.org/show_bug.cgi?id=97608
Note: This bug has been find by `autospec', the work-in-progress tool used by
the QiLinux team to (semi)automatically create specfiles from tarballs and
update/check rpm packages. It's released under GPL and not QiLinux specific.
The latest release can be found at the URL:
ftp://ftp.qilinux.it/pub/QiLinux/devel/tools/autospec/
#include <best/regards.h>
---
Davide Madrisan
QiLinux Security Team Leader
PGP keyID: 4B72B0B9 fp: 2B79 BFF1 EE33 EE8C 3258 E43C CDA8 EFF3 4B72 B0B9
PGP public key: <http://pgp.mit.edu/>
http://www.qilinux.it
----- End forwarded message -----
--
If you come from outside of Finland, you live in wrong country.
-- motd of irc.funet.fi
Please always Cc to me when replying to me on the lists.
---------------------------------------
Received: (at 294832-close) by bugs.debian.org; 13 Feb 2005 14:23:02 +0000
>From katie@ftp-master.debian.org Sun Feb 13 06:23:02 2005
Return-path: <katie@ftp-master.debian.org>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1D0KeM-0004AT-00; Sun, 13 Feb 2005 06:23:02 -0800
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1D0KYz-0008RC-00; Sun, 13 Feb 2005 09:17:29 -0500
From: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
To: 294832-close@bugs.debian.org
X-Katie: $Revision: 1.55 $
Subject: Bug#294832: fixed in kdelibs 4:3.3.2-2
Message-Id: <E1D0KYz-0008RC-00@newraff.debian.org>
Sender: Archive Administrator <katie@ftp-master.debian.org>
Date: Sun, 13 Feb 2005 09:17:29 -0500
Delivered-To: 294832-close@bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
X-CrossAssassin-Score: 6
Source: kdelibs
Source-Version: 4:3.3.2-2
We believe that the bug you reported is fixed in the latest version of
kdelibs, which is due to be installed in the Debian FTP archive:
kdelibs-bin_3.3.2-2_i386.deb
to pool/main/k/kdelibs/kdelibs-bin_3.3.2-2_i386.deb
kdelibs-data_3.3.2-2_all.deb
to pool/main/k/kdelibs/kdelibs-data_3.3.2-2_all.deb
kdelibs4-dev_3.3.2-2_i386.deb
to pool/main/k/kdelibs/kdelibs4-dev_3.3.2-2_i386.deb
kdelibs4-doc_3.3.2-2_all.deb
to pool/main/k/kdelibs/kdelibs4-doc_3.3.2-2_all.deb
kdelibs4_3.3.2-2_i386.deb
to pool/main/k/kdelibs/kdelibs4_3.3.2-2_i386.deb
kdelibs_3.3.2-2.diff.gz
to pool/main/k/kdelibs/kdelibs_3.3.2-2.diff.gz
kdelibs_3.3.2-2.dsc
to pool/main/k/kdelibs/kdelibs_3.3.2-2.dsc
kdelibs_3.3.2-2_all.deb
to pool/main/k/kdelibs/kdelibs_3.3.2-2_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 294832@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org> (supplier of updated kdelibs package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sun, 13 Feb 2005 04:58:29 +0100
Source: kdelibs
Binary: kdelibs4 kdelibs-bin kdelibs kdelibs4-doc kdelibs-data kdelibs4-dev
Architecture: source i386 all
Version: 4:3.3.2-2
Distribution: unstable
Urgency: high
Maintainer: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Changed-By: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Description:
kdelibs - KDE core libraries metapackage
kdelibs-bin - KDE core binaries
kdelibs-data - KDE core shared data
kdelibs4 - KDE core libraries
kdelibs4-dev - KDE core libraries (development files)
kdelibs4-doc - KDE core library documentation
Closes: 270592 290323 292081 292569 292765 294832 294896
Changes:
kdelibs (4:3.3.2-2) unstable; urgency=high
.
+++ Changes by Adeodato Simó:
.
* Include patch to fix CAN-2005-0365, "insecure temporary file creation in
kdelibs 3.3.2". dcopidlng no longer creates its temporary files in /tmp.
(Closes: #294832, #294896) Urgency set to high because of this and other
RC bug fixes below.
.
* KDE_3_3_BRANCH update.
.
* Include patch from CVS to fix XMLHttpRequest POST being broken in KHTML
due to a blank line in headers. (Closes: #292765)
.
+++ Changes by Christopher Martin:
.
* Add patch from upstream that solves the problem wherein programs whose
.desktop entry contained their full path, rather than just the binary
to be executed (mainly games), confused kdeinit.
(Closes: #270592, #290323)
.
* debian/control: Add necessary kdelibs-data Replaces for old
openoffice.org packages. (Closes: #292569)
.
* Add better manpage for lnusertemp. Thanks to Javier Fernández-Sanguino
Peña. (Closes: #292081)
Files:
97bcad06bc3f35a5966d652f31c304ee 1302 libs optional kdelibs_3.3.2-2.dsc
e8fc19fa7b6e05679c0a1685ee7c7ddd 441095 libs optional kdelibs_3.3.2-2.diff.gz
fe0f7edea20e8c0dcdc77a499f1b36bb 854500 libs optional kdelibs-bin_3.3.2-2_i386.deb
e48add20db2debc3583847ae41eac3e7 8186534 libs optional kdelibs4_3.3.2-2_i386.deb
80de26e8a8916a6db994488d55341377 1231148 libdevel optional kdelibs4-dev_3.3.2-2_i386.deb
5ed446dccab56f5f72bce0dbd106a551 18624 kde optional kdelibs_3.3.2-2_all.deb
f1dc691989bb771e344508defeb364b3 7083852 libs optional kdelibs-data_3.3.2-2_all.deb
3ea3e09f919dd12325316ea72b7b4372 11570094 doc optional kdelibs4-doc_3.3.2-2_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
Comment: Signed by Isaac Clerencia <isaac@warp.es>
iD8DBQFCD09IQET2GFTmct4RAujUAJ4jDMiVlyGQfPQDRTI1wI9Wiwox2QCePjH7
zeAG5hDal7zM91Z45OA0sgc=
=6tRo
-----END PGP SIGNATURE-----
Reply to: