diff -u apport-1.0/debian/changelog apport-1.0/debian/changelog
--- apport-1.0/debian/changelog
+++ apport-1.0/debian/changelog
@@ -1,3 +1,14 @@
+apport (1.0-0ubuntu5.1) jaunty-security; urgency=low
+
+  * etc/cron.daily/apport: Only attempt to remove files and symlinks, do not
+    descend into subdirectories of /var/crash/. Doing so might be exploited by
+    a symlink attack in an evil fuse file system or a race condition between
+    find traversing a huge directory tree, changing an existing subdir into a
+    symlink to e. g. /etc/, and finally getting that piped to rm. Thanks to
+    Stephane Chazelas for discovering this! (LP: #357024)
+
+ -- Martin Pitt <martin.pitt@ubuntu.com>  Wed, 15 Apr 2009 21:27:21 +0200
+
 apport (1.0-0ubuntu5) jaunty; urgency=low
 
   * Rename etc/default/apport.default to etc/default/apport (brown paperbag),
only in patch2:
unchanged:
--- apport-1.0.orig/etc/cron.daily/apport
+++ apport-1.0/etc/cron.daily/apport
@@ -1,5 +1,5 @@
 #!/bin/sh -e
 # clean all crash reports which are older than a week.
 [ -d /var/crash ] || exit 0
-find /var/crash -mindepth 1 -mtime +7 -print0 | xargs -0 rm -f
-find /var/crash -mindepth 1 -empty -print0 | xargs -0 rm -f
+find /var/crash -mindepth 1 -maxdepth 1 \( -type f -o -type l \) -mtime +7 -print0 | xargs -0 rm -f
+find /var/crash -mindepth 1 -maxdepth 1 \( -type f -o -type l \) -empty -print0 | xargs -0 rm -f