Your message dated Sat, 08 Nov 2008 15:02:03 +0000
with message-id <[EMAIL PROTECTED]>
and subject line Bug#433900: fixed in gocr 0.46
has caused the Debian Bug report #433900,
regarding call to shell with unquoted user-supplied filenames
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [EMAIL PROTECTED]
immediately.)
--
433900: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=433900
Debian Bug Tracking System
Contact [EMAIL PROTECTED] with problems
--- Begin Message ---
Package: gocr
Version: 0.41-1
Severity: minor
Tags: security
--- Please enter the report below this line. ---
Hi, gocr is calling a child process with sh -c and expands the argument
needlessly.
[10:33] ~ => strace -ff -e fork,execve gocr
big-in-japan-\(alphaville-cover\).png
execve("/usr/bin/gocr", ["gocr", "big-in-japan-(alphaville-cover)."...], [/* 31
vars */]) = 0
Process 14364 attached
[pid 14364] execve("/bin/sh", ["sh", "-c", "pngtopnm
big-in-japan-(alphavill"...], [/* 31 vars */]) = 0
sh: -c: line 0: syntax error near unexpected token `('
sh: -c: line 0: `pngtopnm big-in-japan-(alphaville-cover).png'
Process 14364 detached
--- SIGCHLD (Child exited) @ 0 (0) ---
(null): EOF / read error reading magic number
Process 14363 detached
I can work around this easily by renaming the file ;-), but it could be a
security issue in other cases so I'm tagging it as such.
Regards,
Zoran
--- System information. ---
Architecture: i386
Kernel: Linux 2.6.22-rc3-ck1-suspend2
Debian Release: lenny/sid
700 testing debian.iskon.hr
500 lenny zap.tartarus.org
500 feisty wine.budgetdedicated.com
500 experimental nekkar.carnet.hr
500 experimental jurina.srce.hr
500 debian-unstable download.tuxfamily.org
400 stable www.debian-multimedia.org
400 stable debian.iskon.hr
100 unstable www.debian-multimedia.org
100 unstable debian.iskon.hr
1 experimental debian.iskon.hr
--- Package information. ---
Depends (Version) | Installed
============================-+-=============
libc6 (>= 2.3.6-6) | 2.5-9+b1
libnetpbm10 | 2:10.0-11
--- End Message ---
--- Begin Message ---
Source: gocr
Source-Version: 0.46
We believe that the bug you reported is fixed in the latest version of
gocr, which is due to be installed in the Debian FTP archive:
gocr-tk_0.46_all.deb
to pool/main/g/gocr/gocr-tk_0.46_all.deb
gocr_0.46.dsc
to pool/main/g/gocr/gocr_0.46.dsc
gocr_0.46.tar.gz
to pool/main/g/gocr/gocr_0.46.tar.gz
gocr_0.46_i386.deb
to pool/main/g/gocr/gocr_0.46_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Cosimo Alfarano <[EMAIL PROTECTED]> (supplier of updated gocr package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Sat, 08 Nov 2008 12:36:55 -0200
Source: gocr
Binary: gocr gocr-tk
Architecture: source i386 all
Version: 0.46
Distribution: unstable
Urgency: low
Maintainer: Cosimo Alfarano <[EMAIL PROTECTED]>
Changed-By: Cosimo Alfarano <[EMAIL PROTECTED]>
Description:
gocr - A command line OCR
gocr-tk - A tcl/tk wrapper around gocr
Closes: 316511 433900
Changes:
gocr (0.46) unstable; urgency=low
.
* New upstream release
* Fixed bug with space in filename (Closes: #316511,#433900)
Checksums-Sha1:
c2c34b05d79e1ca55827bf6397b3c29c6b750ebb 740 gocr_0.46.dsc
9674d7cdc14ad677f0d4798d9102bbffc4cca057 317048 gocr_0.46.tar.gz
f710430278d1e0b6be70b292347bbd6bf4d61680 204802 gocr_0.46_i386.deb
ce894a2939bd54dbd3a48d95b1b26adcb9738de2 8848 gocr-tk_0.46_all.deb
Checksums-Sha256:
ac835def021aec9c86f7e6062ca8322d7eaa8597064346491207f50b6de38ae3 740
gocr_0.46.dsc
6fb0e87fea61372382f78974bd1fb39399a05909a2af93f7d86a146d87054043 317048
gocr_0.46.tar.gz
0fbcfedb18253d293fac3e18ea64638a53496a0754c4f19b5127443fa687fe7e 204802
gocr_0.46_i386.deb
8e44edcb1744baf9cdf073373bd076239e0f988e7651ae8dda0d77e9831cff0e 8848
gocr-tk_0.46_all.deb
Files:
da4f7234cee5820eee0b94ff669af88f 740 graphics optional gocr_0.46.dsc
bfa585a5193d264ac3fb24204f0035cf 317048 graphics optional gocr_0.46.tar.gz
9a1d6fd94b8b8667321f173a401b017c 204802 graphics optional gocr_0.46_i386.deb
d9062cb127f22073a7d01c8cc301d91b 8848 graphics optional gocr-tk_0.46_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkkVp6kACgkQ5DsVPMtGfieGbQCgqiyrGXL6h8MKw637YA2/VQ84
dpEAn22gaAM+FeNDwYaKyDtDaiDjJe/U
=sBHM
-----END PGP SIGNATURE-----
--- End Message ---
