Bug#837534: apt-listchanges: postinst runs a Python script out of /tmp/

2016-09-12 Thread Raphael Hertzog
Hi, On Mon, 12 Sep 2016, Robert Luberda wrote: > Thanks, I will create temporary directory instead: [...] > python3 -B "$temp" "$@" > > Do you think this will be OK? Yes. Cheers, -- Raphaël Hertzog ◈ Debian Developer Support Debian LTS: http://www.freexian.com/services/debian-lts.html

Bug#837534: apt-listchanges: postinst runs a Python script out of /tmp/

2016-09-12 Thread Robert Luberda
Raphaël Hertzog writes: > > You should thus create that temporary file in a root-owned > directory which is specific to apt-listchanges. Thanks, I will create temporary directory instead: tempdir=`mktemp --directory --sufix=.aptlc` trap "rm -rf $tempdir" EXIT

Bug#837534: apt-listchanges: postinst runs a Python script out of /tmp/

2016-09-12 Thread Raphaël Hertzog
Package: apt-listchanges Version: 3.3 Severity: critical Tags: security The postinst script runs a Python script that it creates in /tmp/. Unfortunately python will add the directory where the script resides to sys.path and all the imports will be thus resolved in that directory. A simple user