Package: release.debian.org Severity: normal Tags: lenny User: release.debian.org@packages.debian.org Usertags: opu Release managers: Please consider the attached patch for pmake in Lenny. This fixes CVE-2011-1920 and is identical to the patch already applied to unstable. -- Jonathan Wiltshire jmw@debian.org Debian Developer http://people.debian.org/~jmw 4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC 74C3 5394 479D D352 4C51
diff -u pmake-1.111/debian/changelog pmake-1.111/debian/changelog --- pmake-1.111/debian/changelog +++ pmake-1.111/debian/changelog @@ -1,3 +1,11 @@ +pmake (1.111-1+lenny1) oldstable; urgency=low + + * Non-maintainer upload. + * Backport fix for CVE-2011-1920 (symlink attack in bsd.lib.mk + (Closes: #626673) + + -- Jonathan Wiltshire <jmw@debian.org> Wed, 03 Aug 2011 20:31:43 +0100 + pmake (1.111-1) unstable; urgency=low * New upstream snapshot. diff -u pmake-1.111/mk/bsd.prog.mk pmake-1.111/mk/bsd.prog.mk --- pmake-1.111/mk/bsd.prog.mk +++ pmake-1.111/mk/bsd.prog.mk @@ -124,7 +124,7 @@ .if defined(SRCS) afterdepend: .depend - @(TMP=/tmp/_depend$$$$; \ + @(TMP=`mktemp -t _dependXXXXXXXXXX` || exit $$?; \ sed -e 's/^\([^\.]*\).o[ ]*:/\1.o \1.ln:/' \ < .depend > $$TMP; \ mv $$TMP .depend) diff -u pmake-1.111/mk/bsd.lib.mk pmake-1.111/mk/bsd.lib.mk --- pmake-1.111/mk/bsd.lib.mk +++ pmake-1.111/mk/bsd.lib.mk @@ -291,7 +291,7 @@ .if defined(SRCS) afterdepend: .depend - @(TMP=/tmp/_depend$$$$; \ + @(TMP=`mktemp -t _dependXXXXXXXXXX` || exit $$?; \ sed -e 's/^\([^\.]*\).o[ ]*:/\1.o \1.po \1.so \1.ln:/' \ < .depend > $$TMP; \ mv $$TMP .depend)
Attachment:
signature.asc
Description: Digital signature