Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 28 Dec 2008 14:55:57 +0100
From: Robert Buchholz <>
Cc: Tomas Hoger <>,
Subject: Re: CVE request - pdfjam

On Friday 19 December 2008, Tomas Hoger wrote:
> Hi!
> Insecure temporary file handling flaw was reported for pdfjam:
> Issue affects all 3 scripts shipped in pdfjam: pdf90, pdfjoin and
> pdfnup
> They create various temporary files in tempfileDir (/var/tmp),
> process id ($$) is used for file name uniqueness.

Martin Všth also discovered an untrusted search path vulnerability in 
the pdfjam scripts: They prepend . to PATH, allowing attackers to 
execute code by preparing executables (e.g. sed) in the directory 
pdfnup was run from or in /var/tmp (e.g. pdflatex, cp, rm).

Martin also prepared a patch, see:

Please assign another CVE for this issue.


[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ