Re: flashplugin-nonfree get-upstream-version.pl security concern
Moritz Mühlenhoff:
> On Wed, Dec 12, 2012 at 05:52:31PM +0000, adrelanos wrote:
>> Hi,
>>
>> I do not want to discuss security implications of the upstream closed
>> source Adobe Flash plugin. This is about how the Flash plugin is
>> downloaded and installed in Debian.
>>
>> /usr/sbin/update-flashplugin-nonfree downloads get-upstream-version.pl
>> http://people.debian.org/~bartm/flashplugin-nonfree/get-upstream-version.pl.gz.pgp
>> stores it in /tmp/xxx, runs it and deletes /tmp/xxx.
>
> It should at least use a non-predictable tempfile (using tempfile(1) )
>
> Please file bug for that.
It's non-predictable. Sorry, I didn't mention it doesn't use /tmp/xxx.
xxx was supposed to be a variable, i.e. always changing.
Reply to: