Bug#741627: insecure temporary file usage in apt-extracttemplates

[Michael Vogt <mvo@debian.org>]

On Fri, Mar 14, 2014 at 05:10:05PM +0000, Steve Kemp wrote:
> Package: apt
> Version: 0.9.7.9+deb7u1
> Severity: important
> Tags: security

Thanks for your bugreport. 
 
[..]
> Anyway given that the generated file names are output to the console
> it feels like we should use mkstemp and do it properly, right?
[..]

I agree and changed the code to use mkstemp() now instead of using the
pid/static integer combination. Changing this means that the format of
the ouput changes slightly, the last field after the "." is fixed size
now and no longer contains only numbers. I don't expect this to cause
issues, but I will run it on my system first for a couple of days
(I also added a small integration test for this functionatlity).

Cheers,
 Michael