Your message dated Mon, 11 May 2015 11:49:17 +0000
with message-id <[email protected]>
and subject line Bug#784889: fixed in pdf2djvu 0.7.21-1
has caused the Debian Bug report #784889,
regarding pdf2djvu: insecure use of /tmp when executing c44
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
784889: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=784889
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: pdf2djvu
Package: didjvu
Tags: security upstream fixed-upstream
Forwarded: https://bitbucket.org/jwilk/pdf2djvu/issue/103
If background of a page is solid but not white, pdf2djvu does the
following to create the background layer:
creates a unique temporary file directly in /tmp (or in $TMPDIR)
passes name of this file to c44(1) as the output file name
Unfortunately, c44 deletes the output file, and then creates a new one
under the same name (without O_EXCL). This opens a race window, during
which malicious local user could create their own file under this name.
This bug was fixed upstream in pdf2djvu 0.7.21:
https://bitbucket.org/jwilk/pdf2djvu/commits/62c3c48098d6
CVE request:
http://www.openwall.com/lists/oss-security/2015/05/09/7
--
Jakub Wilk
--- End Message ---
--- Begin Message ---
Source: pdf2djvu
Source-Version: 0.7.21-1
We believe that the bug you reported is fixed in the latest version of
pdf2djvu, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Daniel Stender <[email protected]> (supplier of updated pdf2djvu package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 11 May 2015 13:23:09 +0200
Source: pdf2djvu
Binary: pdf2djvu
Architecture: source amd64
Version: 0.7.21-1
Distribution: unstable
Urgency: medium
Maintainer: Daniel Stender <[email protected]>
Changed-By: Daniel Stender <[email protected]>
Description:
pdf2djvu - PDF to DjVu converter
Closes: 784889
Changes:
pdf2djvu (0.7.21-1) unstable; urgency=medium
.
* New upstream release (Closes: #784889).
Checksums-Sha1:
376464b09308794d546042bc0971c5add53fe9b3 2111 pdf2djvu_0.7.21-1.dsc
45128a39fe3fa234902b19a65875a96518c9eb11 229020 pdf2djvu_0.7.21.orig.tar.xz
05404091948dc11f023035afec992b1a2f001855 30636 pdf2djvu_0.7.21-1.debian.tar.xz
43e15468b03b460f2aa90197ffa0f3b705e7dd60 166458 pdf2djvu_0.7.21-1_amd64.deb
Checksums-Sha256:
6709a8aa252c5e9af9af269e73789112b96c1df119b3d99307d841277a930496 2111
pdf2djvu_0.7.21-1.dsc
12d480cc3ce2369e1f1b39b7f5e6fbb44351d8b07861295d34e6978f58b687b9 229020
pdf2djvu_0.7.21.orig.tar.xz
9580104109f0e8e71e54bf071aaad2b1ac3013df5ca86458aabbdb3ddbe69743 30636
pdf2djvu_0.7.21-1.debian.tar.xz
b9518cb8d8884f1319c9388325d6c3c2829325ecdbdbd35fb8608c9ac14f605d 166458
pdf2djvu_0.7.21-1_amd64.deb
Files:
ed82d4e205eecf9859f5965e0685e928 2111 text optional pdf2djvu_0.7.21-1.dsc
1efee113c9985d4102c09ab997fc795d 229020 text optional
pdf2djvu_0.7.21.orig.tar.xz
81ee57b39d7cb44276ef89ab992d00dc 30636 text optional
pdf2djvu_0.7.21-1.debian.tar.xz
8a18533aa3b26b12d514235f7ecc0aeb 166458 text optional
pdf2djvu_0.7.21-1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJVUJIbAAoJEBXgmvTfUYLIh4MQAIPMATvSRzh64ozMCyVUq51x
x9AzR4Rya/fPQvIGcT8TNc+zrnwT+mguFYcrZnVgbANPgZO2Fs88OwkwuAVrCGQf
LqtoaBdGuz4SYjex8c0TyH8FT4wXCwv+MCDfZjA+49Lw1lwSQtnklHIybsXDi32a
Wc9c8zwKDf4thGKkWm9v5YX394tbshhSg8Ymzux4sp4m0/7aM/3wQmz0q8XWkq1o
rYZy4xRAlkBGRg/deyyl8PYH8eX0oZ7A/UQjt4hy94TunJwVapcToMSQA0ifQIfp
D5+p00cRoMHC2tHXDnfpliHHpU+jBlJ/KeZvCcKRrvKTIodwgmNRjnoSkkRHnS/Z
mSJAGF1vBzQelDCADykTb88mwWDeXIsjf9QNrTv5hv5OprzGvtg8xtoD/1etvjdK
C99VnWqYbSuQgTno88fLtgyOCg+A7fJ4g2oBk8YXXcNu7Yty7WrnqxhWbp/RKUVv
2Hf4PY9WxzMpx4mW3xiBcibEIMpbTyhGVsTNy9yj++Ub5lbIaictvMbUGvMH4zey
uJzCK0RWP26tJp16/o20kS3ZR93bImA8Q7eJQZP0pgAyXFUsxndQD80nfYYY+u6+
ofHAG8tSkcvAnCK+QUtULdFEnd73SETnYyIStdm2blHzHsOZje4xujFyHqVY28J8
QJZCziHkMOqQb7YAexyD
=oS1C
-----END PGP SIGNATURE-----
--- End Message ---
