oss-security - Re: CVE request: davfs2 - Unsecure use of system()

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130917145740.GA13465@eldamar.local>
Date: Tue, 17 Sep 2013 16:57:40 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Cc: luciano@...ian.org
Subject: Re: CVE request: davfs2 - Unsecure use of system()

Hi Kurt, hi Luciano,

On Tue, Sep 17, 2013 at 10:13:40AM +0200, Luciano Bello wrote:
> Hi,
>    A security vulnerability have been reported in davfs2 
> http://bugs.debian.org/723034
> 
> Please, assign a CVE id.

As additional reference for this CVE request. The Debian Bugreport
also contains the proposed diffs to apply to 1.4.6 and 1.4.7. But here
are also upstream references.

Upstream Bugreport: http://savannah.nongnu.org/bugs/?40034

Patches: 1.4.6: http://savannah.nongnu.org/bugs/download.php?file_id=29141
         1.4.7: http://savannah.nongnu.org/bugs/download.php?file_id=29142

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.