Re: stalin: CVE-2015-8697: Insecure use of temporary files

From	Salvatore Bonaccorso <carnil@debian.org>
Newsgroups	linux.debian.security
Subject	Re: stalin: CVE-2015-8697: Insecure use of temporary files
Date	2016-01-20 13:00 +0100
Message-ID	<qSZAC-5Pv-3@gated-at.bofh.it> (permalink)
References	<qR4uJ-TT-1@gated-at.bofh.it> <qSZqV-5Mi-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi Rob,

On Wed, Jan 20, 2016 at 05:41:56AM -0600, Rob Browning wrote:
> Rob Browning <rlb@defaultvalue.org> writes:
> 
> > I believe the package is scheduled to be removed next week, and I'm
> > still waiting on a discussion with upstream about a (non-trivial) patch
> > I wrote to attempt to address the problem.
> >
> > So I wanted to ask for an opinion about the claim here that it might be
> > reasonable to lower the severity:
> >
> >   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808730#20
> >
> > Thanks
> 
> I just wanted to ping you, since today's the removal deadline.

Yes I think we can downgrade the severity for it to important, since
the attack vector is mitigated by the symlink restrictions enabled.

Regards,
Salvatore

Back to linux.debian.security | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: stalin: CVE-2015-8697: Insecure use of temporary files Rob Browning <rlb@defaultvalue.org> - 2016-01-15 05:50 +0100
  Re: stalin: CVE-2015-8697: Insecure use of temporary files Rob Browning <rlb@defaultvalue.org> - 2016-01-20 12:50 +0100
    Re: stalin: CVE-2015-8697: Insecure use of temporary files Salvatore Bonaccorso <carnil@debian.org> - 2016-01-20 13:00 +0100

csiph-web