On Wed, 2018-02-14 at 22:23 -0500, Roberto C. Sánchez wrote: > On Wed, Feb 14, 2018 at 02:56:24PM +0530, Abhijith PA wrote: > > Hello. > > > > I prepared LTS security update for leptonlib. Please review and upload. > > You can find debdiff along with the mail. > > link: > > https://mentors.debian.net/debian/pool/main/l/leptonlib/leptonlib_1.69-3.1+deb7u1.dsc > > > > Abhijith, > > I have reviewed and uploaded the package. While you backported the > upstream fix, I feel like their approach falls under item #2 of "The Six > Dumbest Ideas in Computer Security [0]": Enumerating Badness. I cannot > help but wonder if another vulnerability will be uncovered later that > uses different characters that are not being checked.
I found one already: it filters out `command` but not $(command).
I'm afraid this library appears to have been written without any regard
for security, or even the existence of multiuser systems.
Bug #890548 (stack buffer overflows) is probably exploitable in wheezy,
and I think there are more instances.
Bug #885704 (hardcoded paths in /tmp) has been closed in unstable but I
can still see:
$ strings /usr/bin/printsplitimage | grep ^/tmp/
/tmp/split
$ strings /usr/bin/splitimage2pdf | grep ^/tmp/
/tmp/junk_split_image.ps
$ strings /usr/lib/x86_64-linux-gnu/liblept.so.5 | grep ^/tmp/
/tmp/lept/baseline/diff
/tmp/lept/baseline/diff.png
/tmp/lept/baseline/loc
/tmp/lept/baseline/loc.png
/tmp/lept/baseline/skew
/tmp/lept/baseline/baselines.png
/tmp/threshroot
/tmp/lept/plots/sides.%s
/tmp/lept/plots/sides.%d
/tmp/lept/plots/size.%s
/tmp/lept/plots/size.%d
/tmp/linfit/boxalr.ba
/tmp/linfit/boxatb.ba
/tmp/linfit/ptal.pta
/tmp/linfit/ptar.pta
/tmp/linfit/ptat.pta
/tmp/linfit/ptab.pta
/tmp/smooth/boxae.ba
/tmp/smooth/boxao.ba
/tmp/smooth/boxalfe.ba
/tmp/smooth/boxalfo.ba
/tmp/smooth/boxame.ba
/tmp/smooth/boxamo.ba
/tmp/smooth/boxamede.ba
/tmp/smooth/boxamedo.ba
...
Ben.
> In any event, once you receive the ACCEPT notice from the archive
> software you should be able to publish the DLA.
--
Ben Hutchings
Everything should be made as simple as possible, but not simpler.
- Albert Einstein
signature.asc
Description: This is a digitally signed message part
