Bugzilla Bug 22972

[SECURITY] [DSA-323-1] New noweb packages fix insecure temporary file creation 
 
From:  
Matt Zimmerman <mdz@debian.org> 
 
 
To:  
debian-security-announce@lists.debian.org 
 
 
Date:  
Today 04.07.00 
 
 
 
Message was signed with unknown key 0x43E25D1E. 
The validity of the signature cannot be verified. 
 
 
-------------------------------------------------------------------------- 
Debian Security Advisory DSA 323-1                     security@debian.org 
http://www.debian.org/security/                             Matt Zimmerman 
June 16th, 2003                         http://www.debian.org/security/faq 
-------------------------------------------------------------------------- 
 
Package        : noweb 
Vulnerability  : insecure temporary files 
Problem-Type   : local 
Debian-specific: no 
CVE Id         : CAN-2003-0381 
 
Jakob Lell discovered a bug in the 'noroff' script included in noweb 
whereby a temporary file was created insecurely.  During a review, 
several other instances of this problem were found and fixed.  Any of 
these bugs could be exploited by a local user to overwrite arbitrary 
files owned by the user invoking the script.

glsa sent