Gentoo: semi Insecure temp files
The (1) semi MIME library 1.14.5 and earlier, and (2) wemi 1.14.0 andpossibly other versions, allows local users to overwrite arbitrary filesvia a symlink attack on temporary files...
Summary
- - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200308-02 - - ---------------------------------------------------------------------
- - ---------------------------------------------------------------------
quote from CVE:
"The (1) semi MIME library 1.14.5 and earlier, and (2) wemi 1.14.0 and possibly other versions, allows local users to overwrite arbitrary files via a symlink attack on temporary files."
SOLUTION
It is recommended that all Gentoo Linux users who are running app-emacs/semi upgrade to semi-1.14.5-r1 as follows
emerge sync emerge semi emerge clean
- - --------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at usata@gentoo.org
Resolution
References
Availability
Concerns
Severity
PACKAGE : semi
SUMMARY : insecure temporary files creation
DATE : 2003-08-14 19:30 UTC
EXPLOIT : local
VERSIONS AFFECTED : =semi-1.14.5-r1
CVE : CAN-2003-0440
Background
