Bug#762230: lilypond: debian/rules sets HOME=/tmp

2014-09-19 Thread Don Armstrong
On Fri, 19 Sep 2014, Jakub Wilk wrote: > This package's debian/rules sets HOME set to /tmp in debian/rules. But > HOME is supposed to be writable only by trusted users, whereas /tmp is > world-writable. > > For example, python2.7 (which debian/rules indirectly runs) loads code from > $HOME/.local/

Bug#762230: lilypond: debian/rules sets HOME=/tmp

2014-09-19 Thread Jakub Wilk
Source: lilypond Version: 2.18.2-2 Severity: grave Tags: security This package's debian/rules sets HOME set to /tmp in debian/rules. But HOME is supposed to be writable only by trusted users, whereas /tmp is world-writable. For example, python2.7 (which debian/rules indirectly runs) loads cod