Bug#423441: blosxom: param(-f) for exec introduces security hole

2007-05-11 Thread Neale Pickett
Package: blosxom Version: 2.0-14 Severity: grave Tags: security Justification: user security hole On line 69, param(-f) is used as a potential configuration file: for $rcfile (/etc/blosxom/blosxom.conf, /etc/blosxom.conf, param(-f)) { if (-r $rcfile) { open (RC, $rcfile) or die Cannot

Bug#423441: blosxom: param(-f) for exec introduces security hole

2007-05-11 Thread Stephen Gran
This one time, at band camp, Neale Pickett said: On line 69, param(-f) is used as a potential configuration file: for $rcfile (/etc/blosxom/blosxom.conf, /etc/blosxom.conf, param(-f)) { if (-r $rcfile) { open (RC, $rcfile) or die Cannot open $rcfile: $!; while (RC) {