oss-security - Re: CVE request: jhead

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Fri, 6 Feb 2009 18:20:49 +0100
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: jhead

On Thu, 27 Nov 2008 00:21:54 +0100 Robert Buchholz <rbu@...too.org>
wrote:

> These two issues have been resolved in the current
> "jhead-latest.tar.gz" distributed on the upstream site. Both Ubuntu
> and Debian have renamed one version of this file to be "2.85" whereas
> upstream has not yet released any 2.85 version. Upstream stated that
> they will release a 2.85 not before next year, so anyone who has this
> issue open can either extract patches, package the snapshot or wait.

Looks like -latest tarball was updated again and now mentions 2.86
inside.  In that, usage of mkstemp was replaced with mktemp (previous
version failed to close file descriptors opened by mkstemp, probably
causing issues when trying to use command on large pile of images at
once).  Those the temp file seem to be created user-specified
destination directory, probably not too likely to be /tmp (and hence
prone to races).

Anyway, can anyone help me understand what was CVE-2008-4639 assigned
to?  I tried looking at the diff between 2.7 and 2.84 and fail to see
any relevant change...

-- 
Tomas Hoger / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.