Bugzilla Bug 195996

CVE-2007-5200 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5200):
  hugin in SUSE openSUSE 10.2 and 10.3 allows local users to overwrite
  arbitrary files via a symlink attack on a temporary file.

This does not only affect SuSe, but seems to be an upstream problem. Attching
patch applied by suse. It removes debug logging functionality, though.

Graphics, please advise and contact upstream about it. They do not have any fix
in their repository yet.

Created an attachment (id=133580) [edit]
hugin-0.6.1-optim_file.patch

nion from Debian security created a proper patch that was included in the
upstream repository:
http://people.debian.org/~nion/nmu-diff/hugin-0.6.1-1_0.6.1-1.1.patch

Upstream is not going to release an update to their stable 0.6 branch and the
new release is not within days. Graphics, please provide an updated ebuild with
the patch applied.

ebuild prepared

Faster than lightning! Thanks.

Arches, please test and mark stable media-gfx/hugin-0.6.1-r1.
Target keywords : "amd64 ppc x86"

ppc stable

x86 stable, luca did you forget to commit? readding ppc

done eventually

amd64 done, closing

?? please let security team close security bugs.
glsa vote open. I tend to vote YES.

Voting YES.

glsa filed.

As it seems, our unstable 0.7_beta4 is still vulnerable to this. Can it be
removed or updated with a more current SVN snapshot?

(In reply to comment #14)
> As it seems, our unstable 0.7_beta4 is still vulnerable to this. Can it be
> removed or updated with a more current SVN snapshot?
> 

*ping*

(In reply to comment #14)
> As it seems, our unstable 0.7_beta4 is still vulnerable to this. Can it be
> removed or updated with a more current SVN snapshot?

I ported the fix from 0.6 to 0.7 series (just a different line#).

Please do not close security bugs.

GLSa 200712-01, sorry for the delay.