Bugzilla Bug 120224

The following freshmeat information:

A security issue in the SYSLOG interface (POSIX module) and an OPEN/:APPEND
regression have been fixed. SAVEINITMEM can create standalone executables. 

and the ChangeLog:

* POSIX:SYSLOG no longer recognizes "%m" and other formatting instructions.
  For your safety and security, please do all formatting in Lisp.

are unfortunately both not specific about the vulnerability.

please provide fixed ebuilds, thx

I just committed a new ebuild for clisp-2.38. Will we be issuing a GLSA?  I
think the security issue at hand is an unsafe function in CLISP POSIX package,
so my feeling is it is not necessary...

ppc and x86, please mark stable.

Regarding a GLSA, I'm  not sure yet - I guess there will be a vote to decide
that after arches marked stable.

x86 done

ppc stable

lets have a glsa vote. perl had something similar and we issued a glsa back
then. Though i'd say no, C also has unsafe formatted printing functions and
nobody would "fix" them...

I tend to vote YES.

I tend to vote no...

This is not really a security issue. It's a security improvement, that removes
some POSIX compatibility functions that would be unsafe if improperly used.

Correcting to full NO and closing, feel free to reopen if you disagree.