patch (2.7.5-1ubuntu0.16.04.2) xenial-security; urgency=medium
* SECURITY UPDATE: Directory traversal
- debian/patches/CVE-2019-13636.patch: Don't follow symlinks unless
--follow-symlinks is given in src/inp.c, src/util.c.
- CVE-2019-13636
* SECURITY UPDATE: Shell command injection
- debian/patches/CVE-2019-13638.patch: Invoke ed directly instead of
using the shell in src/pch.c.
- CVE-2019-13638
Date: 2019-07-23 16:28:17.236712+00:00
Changed-By: leo.barb...@canonical.com (Leonidas S. Barbosa)
Signed-By: Ubuntu Archive Robot
<cjwatson+ubuntu-archive-ro...@chiark.greenend.org.uk>
https://launchpad.net/ubuntu/+source/patch/2.7.5-1ubuntu0.16.04.2
Sorry, changesfile not available.
--
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/xenial-changes
