Package: gnus Version: 5.10.6-0.CVS.20050317-1 This code trap "test -f $LOG && mv -f $LOG $ELCDIR/install.log > /dev/null 2>&1" exit in /usr/lib/emacsen-common/packages/install/gnus is wrong.
If the file $LOG is already moved successfully by this mv -f $LOG $ELCDIR/install.log then a malicious other process could create $LOG again with junk contents and cause the original install.log to be overwritten with the file of their choice. This is not a serious security problem since the consequences are minor but it should be fixed. The fix is LOG=$ELCDIR/install.log.new instead of using /tmp. Ian. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
