Re: SVN tex-common commit: r4812 - in tex-common/trunk: conf/texmf.d debian debian/po

[Frank Küster <frank@debian.org>]

Norbert Preining <preining@logic.at> wrote:

> On Di, 29 Mär 2011, Frank Küster wrote:
>> > - disable shell_escape completely, fix for DSA-2198-1, CVE-2011-1400
>> 
>> Is the rationale for this change somewhere documented?  Will upstream
>> follow the same reasoning?
>
> Reason: arbitrary code execution
> upstream ha retracted before the releae of TL2009, but we forgot
> to follow that in our texmf.cnf in tex-common. It was some time
> in TL2009 dev cycle.
>
> For TL2010 this was activated again for a very limited amount
> of programs where we verfied that no arbitrary writing outside
> the local dir etc can be done.

Ah, thanks.  We, and I, indeed bluntly forgot that:  When the activation
of a limited number of programs was discussed in TL 2010, I followed the
discussion and was sure that we had it deactivated...

Regards, Frank
-- 
Dr. Frank Küster
VCD Miltenberg, ADFC Aschaffenburg-Miltenberg
B90/Grüne KV Miltenberg
Debian Developer (TeXLive)