click (0.4.21.1ubuntu0.2) trusty-security; urgency=medium
* SECURITY UPDATE: fix privilege escalation via crafted data.tar.gz that
can be used to install alternate security policy than what is defined
- click/install.py: Forbid installing packages with data tarball members
whose names do not start with "./". Based on patch from Colin Watson.
- CVE-2015-XXXX
- LP: #1506467
Date: 2015-10-15 15:23:24.256106+00:00
Changed-By: Jamie Strandboge <[email protected]>
Maintainer: Colin Watson <[email protected]>
https://launchpad.net/ubuntu/+source/click/0.4.21.1ubuntu0.2
Sorry, changesfile not available.
--
Trusty-changes mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/trusty-changes
