| 2013-08-08 17:26:17 |
Andreas Moog |
description |
Imported from Debian bug http://bugs.debian.org/705690:
Package: libuser
Severity: important
Tags: security
Hi,
the following vulnerabilities were published for libuser.
CVE-2012-5630[0]:
TOCTOU race conditions by copying and removing directory trees
CVE-2012-5644[1]:
(Complete) Information disclosure when moving user's home directory
The patch however looks unfortunately quite substantial, see [2], so
might be better to update for unstable directly to the new upstream
version.
Ghe, are you still interested/maintaining the package? I wonder
because there was no upload since 2008 apart NMUs.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] http://security-tracker.debian.org/tracker/CVE-2012-5630
[1] http://security-tracker.debian.org/tracker/CVE-2012-5644
[2] https://bugzilla.redhat.com/show_bug.cgi?id=885724#c7
Regards,
Salvatore
|
Imported from Debian bug http://bugs.debian.org/705690:
Package: libuser
Severity: important
Tags: security
Hi,
the following vulnerabilities were published for libuser.
CVE-2012-5630[0]:
TOCTOU race conditions by copying and removing directory trees
CVE-2012-5644[1]:
(Complete) Information disclosure when moving user's home directory
The patch however looks unfortunately quite substantial, see [2], so
might be better to update for unstable directly to the new upstream
version.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] http://security-tracker.debian.org/tracker/CVE-2012-5630
[1] http://security-tracker.debian.org/tracker/CVE-2012-5644
[2] https://bugzilla.redhat.com/show_bug.cgi?id=885724#c7
Regards,
Salvatore |
|
