Insecure temporary file creation in strace option
Bug #782862 reported by
Emanuel Bronshtein
This bug affects 3 people
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| f-spot (Ubuntu) |
Confirmed
|
Undecided
|
Unassigned | ||
Bug Description
Binary package hint: f-spot
strace option inside /usr/bin/f-spot create temporary file with fixed name "f-spot.strace" under /tmp .
test case :
emanuel@
emanuel@
f-spot.strace
the bug can be found at :
elif $run_strace; then
strace -ttt -f -o /tmp/f-spot.strace mono $MONO_OPTIONS $EXE_TO_RUN "$@"
fix :
use mktemp instead : `mktemp "/tmp/f-
| Changed in f-spot (Ubuntu): | |
| status: | New → Confirmed |
| security vulnerability: | no → yes |
| tags: | added: f-spot security vulnerability |
To post a comment you must log in.
