Your message dated Mon, 10 Jun 2013 15:20:13 +0000
with message-id <[email protected]>
and subject line Bug#708924: fixed in nodau 0.3.5-1
has caused the Debian Bug report #708924,
regarding nodau: Unsafe handling of temporary files when using external editor
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
708924: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708924
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: nodau
Version: 0.3.1-1
Severity: important
Tags: security upstream
Control: forwarded -1 https://github.com/darkrose/nodau/issues/17
[opened in Debian to track the issue]
nodau unsafely handles temporary files when using external editor,
possibly allowing a malicious user to overwrite files or disclose
information (but on recent kernels fs.protected_symlinks might need to
be disabled).
But in any case notes contents are leaked (depending on user umask,
opening an existing note) in /tmp/nodau.$timestamp.
Prerequisite for this to happen is that user sets either $EDITOR
environment variable or external_editor setting in
~/.config/nodau/nodau.conf.
Salvatore
--- End Message ---
--- Begin Message ---
Source: nodau
Source-Version: 0.3.5-1
We believe that the bug you reported is fixed in the latest version of
nodau, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated nodau package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 10 Jun 2013 16:35:41 +0200
Source: nodau
Binary: nodau
Architecture: source amd64
Version: 0.3.5-1
Distribution: unstable
Urgency: low
Maintainer: Salvatore Bonaccorso <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Description:
nodau - simple console based note taking program
Closes: 708924
Changes:
nodau (0.3.5-1) unstable; urgency=low
.
* Imported Upstream version 0.3.5
+ Fixes unsafe handling of temporary files when using a external editor
(Closes: #708924).
* Update copyright years for upstream files
Checksums-Sha1:
a0743b6bd0f905212a7760ddcf76630cf7fedd65 1721 nodau_0.3.5-1.dsc
012fc412239377736ad8361c98f3b25aa0ad5863 26230 nodau_0.3.5.orig.tar.gz
069f443f6ff568b2830774e9fc8ce2d2a767d438 3545 nodau_0.3.5-1.debian.tar.gz
6fba4ddc72cb6335abae0bbbb3eecff8b339f019 21302 nodau_0.3.5-1_amd64.deb
Checksums-Sha256:
ae337a3f9ad63001c4f55389bbd182ec541ba699a0d47401cb901a98115db0ab 1721
nodau_0.3.5-1.dsc
865c373af0589cc68c9e72ee75de4772e9de193a1b4c8efb5347fec1ba34b3dd 26230
nodau_0.3.5.orig.tar.gz
af4dd236daa6aefd5a77f9180a8fc540fab76832bdcdc9a37b3573e4b6fd47b5 3545
nodau_0.3.5-1.debian.tar.gz
ddac3e8f3cffd744a01695555504d8913daf579d03cdf1440fed0da6b5b1680d 21302
nodau_0.3.5-1_amd64.deb
Files:
beae2dc56e20f4f8cd46c8a91a4f9883 1721 utils extra nodau_0.3.5-1.dsc
1972d51286c3c11915cf24256f1c9260 26230 utils extra nodau_0.3.5.orig.tar.gz
ee6abb5fefea003d7b266602038bb6ee 3545 utils extra nodau_0.3.5-1.debian.tar.gz
fa06a3b068271d4f24b57edec2a90732 21302 utils extra nodau_0.3.5-1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBCgAGBQJRteVBAAoJEHidbwV/2GP+fXIQAPBQhFIRDcL1Or6SZuimhv5m
PftGAQ6hj2Q45HS39yvQSrDpsGJyczUIUVy3GqmU2oipdK7tYq1YmKfp4S6KFkKU
dobo85vN2Jo8x5YOVj2no8WmdSrdeYl9rItz7QjSbxOkrsbObIMeAyMbAScT2cGh
j7MibgaGb04kTuqZQcrrz4ttZSleVg3ehw7rRUzGzHlDfTNCQlofJ+rTRRNKzjVb
EffqujcwDlEiRY6FZ++1ZhWAVyUpLVsR23HTXj8jjw7ZNx8at+vnGgUzlNCBj4UQ
SJmUfafW6qj0Xzvki6SET78O/T272Rur0EH6KgMuVN1U+klQvlpeoZvkMf94sX1D
qWSFn6jqq1gqCN7mKw3L6YNz57IdbOA/YnhbY9SIFtsx5HEoomR1bb6QAW2piAis
iR8r0L6Dfi5fchi/zcyf3IweeoWi0IjGYMs9AfcHu88Mil83AcIe0nn6OQZDkWZK
CROP9H9iVqapgC+ATprR3TPeO/wa57pKYXyDGOSfINnknJxpUhKr3rNngNy32y03
zaClOxLa1vTwQCfmIrtBLasEtRPUVKJIAb7gwkp9YBlkEndtIviUggfJ+BuzoJGQ
/autG8R1YNLcUASxWS5EwqHUVlV+euSJ2hNgJl3+36LC85bliIduGKd2tRJp4dDG
KrDew9LhwWvso58MWaqs
=ymu8
-----END PGP SIGNATURE-----
--- End Message ---
