Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #4478 > unrolled thread
| Started by | Rob Browning <rlb@defaultvalue.org> |
|---|---|
| First post | 2016-01-15 05:50 +0100 |
| Last post | 2016-01-20 13:00 +0100 |
| Articles | 3 — 2 participants |
Back to article view | Back to linux.debian.security
Re: stalin: CVE-2015-8697: Insecure use of temporary files Rob Browning <rlb@defaultvalue.org> - 2016-01-15 05:50 +0100
Re: stalin: CVE-2015-8697: Insecure use of temporary files Rob Browning <rlb@defaultvalue.org> - 2016-01-20 12:50 +0100
Re: stalin: CVE-2015-8697: Insecure use of temporary files Salvatore Bonaccorso <carnil@debian.org> - 2016-01-20 13:00 +0100
| From | Rob Browning <rlb@defaultvalue.org> |
|---|---|
| Date | 2016-01-15 05:50 +0100 |
| Subject | Re: stalin: CVE-2015-8697: Insecure use of temporary files |
| Message-ID | <qR4uJ-TT-1@gated-at.bofh.it> |
I believe the package is scheduled to be removed next week, and I'm still waiting on a discussion with upstream about a (non-trivial) patch I wrote to attempt to address the problem. So I wanted to ask for an opinion about the claim here that it might be reasonable to lower the severity: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808730#20 Thanks -- Rob Browning rlb @defaultvalue.org and @debian.org GPG as of 2011-07-10 E6A9 DA3C C9FD 1FF8 C676 D2C4 C0F0 39E9 ED1B 597A GPG as of 2002-11-03 14DD 432F AE39 534D B592 F9A0 25C8 D377 8C7E 73A4
[toc] | [next] | [standalone]
| From | Rob Browning <rlb@defaultvalue.org> |
|---|---|
| Date | 2016-01-20 12:50 +0100 |
| Message-ID | <qSZqV-5Mi-1@gated-at.bofh.it> |
| In reply to | #4478 |
Rob Browning <rlb@defaultvalue.org> writes: > I believe the package is scheduled to be removed next week, and I'm > still waiting on a discussion with upstream about a (non-trivial) patch > I wrote to attempt to address the problem. > > So I wanted to ask for an opinion about the claim here that it might be > reasonable to lower the severity: > > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808730#20 > > Thanks I just wanted to ping you, since today's the removal deadline. Thanks -- Rob Browning rlb @defaultvalue.org and @debian.org GPG as of 2011-07-10 E6A9 DA3C C9FD 1FF8 C676 D2C4 C0F0 39E9 ED1B 597A GPG as of 2002-11-03 14DD 432F AE39 534D B592 F9A0 25C8 D377 8C7E 73A4
[toc] | [prev] | [next] | [standalone]
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2016-01-20 13:00 +0100 |
| Message-ID | <qSZAC-5Pv-3@gated-at.bofh.it> |
| In reply to | #4492 |
[Multipart message — attachments visible in raw view] — view raw
Hi Rob, On Wed, Jan 20, 2016 at 05:41:56AM -0600, Rob Browning wrote: > Rob Browning <rlb@defaultvalue.org> writes: > > > I believe the package is scheduled to be removed next week, and I'm > > still waiting on a discussion with upstream about a (non-trivial) patch > > I wrote to attempt to address the problem. > > > > So I wanted to ask for an opinion about the claim here that it might be > > reasonable to lower the severity: > > > > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808730#20 > > > > Thanks > > I just wanted to ping you, since today's the removal deadline. Yes I think we can downgrade the severity for it to important, since the attack vector is mitigated by the symlink restrictions enabled. Regards, Salvatore
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.security
csiph-web