Bug#763780: apt-get: Insecure temporary changelog handling

2014-10-08 Thread Michael Vogt
On Thu, Oct 02, 2014 at 06:29:45PM +0200, Guillem Jover wrote: Package: apt Version: 0.8.7 Severity: serious Tags: security patch Thanks for your bugreport and your patch! I've found an instance of insecure temporary filenames handling. The problem is that the code correctly creates a

Bug#763780: apt-get: Insecure temporary changelog handling

2014-10-08 Thread Guillem Jover
Hi! On Wed, 2014-10-08 at 10:42:07 +0200, Michael Vogt wrote: On Thu, Oct 02, 2014 at 06:29:45PM +0200, Guillem Jover wrote: Package: apt Version: 0.8.7 Severity: serious Tags: security patch Attached a patch fixing this. This affects all versions starting from the one in squeeze.

Bug#763780: apt-get: Insecure temporary changelog handling

2014-10-02 Thread Guillem Jover
Package: apt Version: 0.8.7 Severity: serious Tags: security patch Hi! I've found an instance of insecure temporary filenames handling. The problem is that the code correctly creates a temporary directory, but then uses that name as just a prefix for the created changelog filename, thus creating