~ubuntu-branches/ubuntu/jaunty/apport/jaunty-security

Viewing all changes in revision 154.

  • Committer: Package Import Robot
  • Author(s): Jamie Strandboge, Martin Pitt
  • Date: 2009-04-29 08:33:09 UTC
  • Revision ID: package-import@ubuntu.com-20090429083309-04kts8l00d3m7lwt
Tags: 1.0-0ubuntu5.2
[ Martin Pitt ]
* etc/cron.daily/apport: Only attempt to remove files and symlinks, do not
  descend into subdirectories of /var/crash/. Doing so might be exploited by
  a race condition between find traversing a huge directory tree, changing
  an existing subdir into a symlink to e. g. /etc/, and finally getting that
  piped to rm. Patch based on work by Martin Pitt. Thanks to Stephane
  Chazelas for discovering this!
  - LP: #357024
  - CVE-2009-1295

expand all expand all

Show diffs side-by-side

added added

removed removed

Lines of Context: