First Last Prev Next    No search results available      Search page      Enter new bug
Bug#: 163220
Alias:
Product:
Component:
Status: RESOLVED
Resolution: DUPLICATE of bug 66400
Assigned To: Gentoo Security <security@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Raphael Marichez <falco@gentoo.org>
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:
Flags: Requestee:
 
 
  ()

Filename Description Type Creator Created Size Actions
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 163220 depends on: Show dependency tree
Show dependency graph
Bug 163220 blocks:

Additional Comments: (this is where you put emerge --info)







View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug

Description:   Opened: 2007-01-22 11:27 0000 
Hi,

ed allows a local user to overwrite arbitrary files via a symlink attack.

Fixed in ed-0.3

base-system team, please advise.

------- Comment #1 From SpanKY 2007-01-22 18:03:19 0000 ------- 
ed-0.4 now in portage

------- Comment #2 From Matthias Geerdsen 2007-01-22 20:04:24 0000 ------- 
thanks vapier....

arches please test sys-apps/ed-0.4 and mark stable if possible

------- Comment #3 From Ulrich Müller 2007-01-22 20:25:48 0000 ------- 
Please note that the open_sbuf() security issue mentioned in the CVE was fixed
in the Gentoo version of ed more than 2 years ago, see bug #66400, bug #73858,
and GLSA 200410-07.

sys-apps/ed-0.2-r6 is definitely _not_ affected by the issue.

------- Comment #4 From Matthias Geerdsen 2007-01-22 20:34:16 0000 ------- 
good catch, that indeed appears to be the case

vapier, could you confirm?

------- Comment #5 From SpanKY 2007-01-23 00:56:47 0000 ------- 
that does seem to be the case

------- Comment #6 From Gustavo Zacarias (RETIRED) 2007-01-23 13:17:18 0000 ------- 
sparc stable.

------- Comment #7 From Raphael Marichez 2007-01-23 13:53:22 0000 ------- 

*** This bug has been marked as a duplicate of bug 66400 ***

------- Comment #8 From Raphael Marichez 2007-01-23 13:56:33 0000 ------- 
arches, no need to mark this as stable now, Ulrich is right (comment #3).
Thanks to him. Those who have already marked stable, you are free to decide
what you prefer to do.

------- Comment #9 From Gustavo Zacarias (RETIRED) 2007-01-23 13:58:56 0000 ------- 
We'll just leave it stable and roll back if there's any problem with the newer
version.

------- Comment #10 From René Nussbaumer 2007-01-23 20:50:27 0000 ------- 
stable on hppa
First Last Prev Next    No search results available      Search page      Enter new bug