146903 2006-09-08 22:53 0000 sys-fs/e2fsprogs-1.39 creates (and leaves) a file sed.script in /tmp 2006-09-09 03:26:56 0000 1 1 1 Unclassified Gentoo Linux Ebuilds unspecified All Linux RESOLVED FIXED P2 trivial --- 1 throw_away_2002@yahoo.com base-system@gentoo.org throw_away_2002@yahoo.com 2006-09-08 22:53:19 0000 I don't know if this represents something harmless, or a little more important (maybe even a possible security problem), so I left the priority and severity at the default levels, but emerging sys-fs/e2fsprogs-1.39 (the current latest stable version) creates and leaves a file called sed.script in /tmp (owned by root:root). The contents of the file: /^#/d /^$/d s/__extension__ // s/typedef \(.*\) __u\([1-9]*\);/#define __U\2_TYPEDEF \1/ s/typedef \(.*\) __s\([1-9]*\);/#define __S\2_TYPEDEF \1/ I don't know much about sed (and not much about problems that lead to security issues), but I thought that creating files in /tmp with known names provided an opportunity for mischief. Thanks. vapier@gentoo.org 2006-09-09 03:26:56 0000 ugh, what an ugly little piece of code that generates this garbage thanks for the bug report, should be fixed in cvs now