-
Committer:
Package Import Robot
-
Author(s):
Jamie Strandboge, Martin Pitt
-
Date:
2009-04-29 08:33:09 UTC
-
Revision ID:
package-import@ubuntu.com-20090429083309-04kts8l00d3m7lwt
Tags: 1.0-0ubuntu5.2
[ Martin Pitt ]
* etc/cron.daily/apport: Only attempt to remove files and symlinks, do not
descend into subdirectories of /var/crash/. Doing so might be exploited by
a race condition between find traversing a huge directory tree, changing
an existing subdir into a symlink to e. g. /etc/, and finally getting that
piped to rm. Patch based on work by Martin Pitt. Thanks to Stephane
Chazelas for discovering this!
- LP: #357024
- CVE-2009-1295