Package: texlive-binaries
Version: 2014.20140926.35254-4
Tags: security
This is how mktexlsr uses temporary files (with boring parts snipped):
treefile="${TMPDIR-/tmp}/mktexlsrtrees$$.tmp"
# ...
while test $# -gt 0; do
# ...
(umask 077
if echo "$1" >>"$treefile"; then :; else
echo "$progname: $treefile: could not append to arg file, goodbye." >&2
exit 1
fi
# ...
done
This is insecure because the filename is predictable and, more
importantly, the program doesn't fail atomically if the file already
exists.
Please use mktemp(1) for creating temporary files.
--
Jakub Wilk
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
