Your message dated Tue, 27 May 2014 21:45:43 +0000
with message-id <[email protected]>
and subject line Bug#748766: fixed in scheme48 1.9-4
has caused the Debian Bug report #748766,
regarding scheme48: Insecure use of temporary file for communication.
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
748766: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=748766
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: scheme48
Version: 1.8+dfsg-1
Severity: important
Tags: security
The function `scheme48-send-definition` in cmuscheme48.el blindly
overwrites the file /tmp/s48lose.tmp prior to sending it to
the inferior scheme process.
This action will blindly overwrite files the user has permission
to modify, causing data-loss.
The function should be modified to generate a secure and non-predictable
filename, perhaps via `make-temp-file` or similar.
-- System Information:
Debian Release: 7.5
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 3.12-0.bpo.1-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF8, LC_CTYPE=en_US.UTF8 (charmap=UTF-8) (ignored: LC_ALL
set to en_US.UTF8)
Shell: /bin/sh linked to /bin/dash
Steve
--
http://steve.org.uk/
--- End Message ---
--- Begin Message ---
Source: scheme48
Source-Version: 1.9-4
We believe that the bug you reported is fixed in the latest version of
scheme48, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thorsten Alteholz <[email protected]> (supplier of updated scheme48 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Tue, 27 May 2014 19:00:00 +0200
Source: scheme48
Binary: scheme48 scheme48-doc cmuscheme48-el
Architecture: source amd64 all
Version: 1.9-4
Distribution: unstable
Urgency: medium
Maintainer: Thorsten Alteholz <[email protected]>
Changed-By: Thorsten Alteholz <[email protected]>
Description:
cmuscheme48-el - Emacs mode specialized for Scheme48
scheme48 - simple, modular, and lightweight Scheme implementation
scheme48-doc - Documentation for the Scheme48 implementation of Scheme
Closes: 748766
Changes:
scheme48 (1.9-4) unstable; urgency=medium
.
* patch for insecure use of tmpfile (Closes: #748766)
(reported by Steve Kemp, patch by Michael Sperber)
Checksums-Sha1:
389aaa0cf101bc2aaf2c6e8b795cb47edee98099 1301 scheme48_1.9-4.dsc
8fd78d328a8c39ecd848e849ade094c30c2bb4ba 3945425 scheme48_1.9.orig.tar.gz
ffee1fbf97d339153bfb24c881aeab8778cb8a97 18364 scheme48_1.9-4.debian.tar.xz
3712a047894ed8746c5e20e070ed5da4aa0d3c12 1120550 scheme48_1.9-4_amd64.deb
7017aba9a1fa97eea2706d556aa3df754a307379 735554 scheme48-doc_1.9-4_all.deb
c71a2a1418366be5378f657c458f4e3dc0f7d659 34178 cmuscheme48-el_1.9-4_all.deb
Checksums-Sha256:
d24a176bc79a160aa5ad6eaf8895cbcbe450d56360b315a293e3393a0bf0a2eb 1301
scheme48_1.9-4.dsc
dcba91d150b7490e6170ef4fbd45a065ba0d8d6e228946379da0d1d7cba78267 3945425
scheme48_1.9.orig.tar.gz
109c5c2c02502078c44449a884d8eececdbf93a71460ef3a636c88e6ffbca784 18364
scheme48_1.9-4.debian.tar.xz
cee456d83a4900a97a2e37da95795fd1990c78524bbb32e603cf1d06f1ea795c 1120550
scheme48_1.9-4_amd64.deb
9bf51a4e870c1c6262edd5e335fbf2ee0d40583bd2757bfaed03d7542e86b8fa 735554
scheme48-doc_1.9-4_all.deb
8886978d9eca3384981185c8b12293013117a95a436ba5c20697a66290e70089 34178
cmuscheme48-el_1.9-4_all.deb
Files:
f36105c403bc2e06c88aa07c9a983f05 1120550 lisp optional scheme48_1.9-4_amd64.deb
951cfdd3f0fdb4a62239b9ad0d7ea811 735554 doc optional scheme48-doc_1.9-4_all.deb
0fd2b4425571b19064f01a210e1bcab0 34178 lisp optional
cmuscheme48-el_1.9-4_all.deb
00f39ed7fd27977ef70a6070f965227e 1301 lisp optional scheme48_1.9-4.dsc
b4c20057f92191d05a61fac1372878ad 3945425 lisp optional scheme48_1.9.orig.tar.gz
f4809c09954a5550976b85d8fcfc78ba 18364 lisp optional
scheme48_1.9-4.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlOE9uwACgkQ02K2KlS5mJA3QgCfUnCxsOaULmZni4mQcKPlry+l
TasAn3WJEDG/bT8GAnAiBzRFwHRt/Q+k
=tIy1
-----END PGP SIGNATURE-----
--- End Message ---
