Your message dated Thu, 06 Nov 2008 09:17:14 +0000
with message-id <[EMAIL PROTECTED]>
and subject line Bug#504352: fixed in eog 2.22.3-2
has caused the Debian Bug report #504352,
regarding eog: Python scripts load modules from current directory
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [EMAIL PROTECTED]
immediately.)
--
504352: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504352
Debian Bug Tracking System
Contact [EMAIL PROTECTED] with problems
--- Begin Message ---
Package: eog
Version: 2.22.3-1
Severity: grave
Tags: security patch
Justification: user security hole
Usertags: pythonpath
eog's python interface calls PySys_SetArgv with an argv[0] that doesn't
resolve to a filename. This causes Python to prepend sys.path with an
empty string which, due to the use of relative imports, allows the
possibility to run arbitrary code on the user's system if a file in
their working directory matches the name of a python module eog tries to
import.
This should be fixed by Python 2.6 as it uses absolute imports by
default, but I have not been able to test it and this still needs a fix
for packages built against/used with the currently supported versions of
Python.
--
James
GPG Key: 1024D/61326D40 2003-09-02 James Vega <[EMAIL PROTECTED]>
--- a/src/eog-python-module.c
+++ b/src/eog-python-module.c
@@ -388,6 +388,9 @@
PySys_SetArgv (1, argv);
+ /* Sanitize sys.path */
+ PyRun_SimpleString("import sys; sys.path = filter(None, sys.path)");
+
if (!check_pygtk2 ()) {
/* Warning message already printed in check_pygtk2 */
goto python_init_error;
signature.asc
Description: Digital signature
--- End Message ---
--- Begin Message ---
Source: eog
Source-Version: 2.22.3-2
We believe that the bug you reported is fixed in the latest version of
eog, which is due to be installed in the Debian FTP archive:
eog-dbg_2.22.3-2_amd64.deb
to pool/main/e/eog/eog-dbg_2.22.3-2_amd64.deb
eog-dev_2.22.3-2_all.deb
to pool/main/e/eog/eog-dev_2.22.3-2_all.deb
eog_2.22.3-2.diff.gz
to pool/main/e/eog/eog_2.22.3-2.diff.gz
eog_2.22.3-2.dsc
to pool/main/e/eog/eog_2.22.3-2.dsc
eog_2.22.3-2_amd64.deb
to pool/main/e/eog/eog_2.22.3-2_amd64.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Josselin Mouette <[EMAIL PROTECTED]> (supplier of updated eog package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Thu, 06 Nov 2008 09:04:21 +0100
Source: eog
Binary: eog eog-dbg eog-dev
Architecture: source all amd64
Version: 2.22.3-2
Distribution: unstable
Urgency: high
Maintainer: Guilherme de S. Pastore <[EMAIL PROTECTED]>
Changed-By: Josselin Mouette <[EMAIL PROTECTED]>
Description:
eog - Eye of GNOME graphics viewer program
eog-dbg - Eye of GNOME graphics viewer program - debugging symbols
eog-dev - Development files for the Eye of GNOME
Closes: 504352
Changes:
eog (2.22.3-2) unstable; urgency=high
.
[ Deng Xiyue ]
* 02_sanitize_sys.path.patch: fix possible security problem caused by
empty sys.path which allows the possibility to run arbitrary code by a
file matches the name of a python module in user's working directory.
Thanks James Vega <[EMAIL PROTECTED]> for the patch.
(Closes: #504352)
Checksums-Sha1:
b9b9fa5d60d7c12d1779c7e86fd43420d3ca7321 1760 eog_2.22.3-2.dsc
88cd7dae28d0ac3a8c7a90bf8c8497444c2a30d1 12806 eog_2.22.3-2.diff.gz
8b9a65f0e638468af4ded527785d724e0cd9fdcc 81452 eog-dev_2.22.3-2_all.deb
3c956063729f37cb7054596e815781489c02c0f5 2145448 eog_2.22.3-2_amd64.deb
6e19d6cf18b24e53f9b63cd54a0cb4f506cd03e0 631962 eog-dbg_2.22.3-2_amd64.deb
Checksums-Sha256:
61e90102ff0765e0def54936f8b3ed8161fd7d40cac46da8f70759c2f8796a50 1760
eog_2.22.3-2.dsc
1ff32fcb605c336de9a5887eba5a9e8de40b50da7060a72ba6c325581a96d72a 12806
eog_2.22.3-2.diff.gz
0d7432581bbf11baee0d6ef78484c348fddf7d32e1d90f692358c60c96b11985 81452
eog-dev_2.22.3-2_all.deb
258b0eb93737ea9a0f27a4186e2bb4c51d6786ef757fd4e72242f4c4becb3d40 2145448
eog_2.22.3-2_amd64.deb
14f49aeb1d17ae4492bb32b76a81d814b250aae857b7938672375e03daf673ec 631962
eog-dbg_2.22.3-2_amd64.deb
Files:
c58342d95c9b9f488f714135dbb913d5 1760 gnome optional eog_2.22.3-2.dsc
c3592268991190ace97dd619b2b4ee78 12806 gnome optional eog_2.22.3-2.diff.gz
a49caaeaace39a101a2ab58957f68b64 81452 gnome optional eog-dev_2.22.3-2_all.deb
0476a51c03663a79ea13ce68738e8f0a 2145448 gnome optional eog_2.22.3-2_amd64.deb
8d686780c8eba2f0bf8da08c1c18b925 631962 gnome extra eog-dbg_2.22.3-2_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFJEqeArSla4ddfhTMRApMTAJ9lcW1WOhTbs76dIijvBHrcCFOXwwCgn7c5
skEN6Qo22TnqNL56zSX8Vvo=
=0shJ
-----END PGP SIGNATURE-----
--- End Message ---
