libuser: CVE-2012-5630 CVE-2012-5644

[Andreas Moog]

Imported from Debian bug http://bugs.debian.org/705690:

Package: libuser
Severity: important
Tags: security

Hi,

the following vulnerabilities were published for libuser.

CVE-2012-5630[0]:
TOCTOU race conditions by copying and removing directory trees

CVE-2012-5644[1]:
(Complete) Information disclosure when moving user's home directory

The patch however looks unfortunately quite substantial, see [2], so
might be better to update for unstable directly to the new upstream
version.

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] http://security-tracker.debian.org/tracker/CVE-2012-5630
[1] http://security-tracker.debian.org/tracker/CVE-2012-5644
[2] https://bugzilla.redhat.com/show_bug.cgi?id=885724#c7

Regards,
Salvatore

[Mattia Rizzolo (mapreri)]

in the meantime this has been fixed and synced.