Package: ffgtk Version: 0.8.1-2 Severity: normal Hello,
I ran ffgtk and noticed that it creates /tmp/fritzbox-login.html /tmp/fritzbox-check.html and /tmp/fritzbox-firmware.html when doing the initial setup. I don't know if the files are created in a way that could be used with a symlink attack, but even if this is not a security issue, after a user has started ffgtk, it seems that no other user can run it until those files are cleaned from /tmp. Ciao, Enrico -- System Information: Debian Release: jessie/sid APT prefers testing APT policy: (500, 'testing') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 3.9-1-amd64 (SMP w/4 CPU cores) Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages ffgtk depends on: ii gconf-service 3.2.6-1 ii libatk1.0-0 2.8.0-2 ii libc6 2.17-6 ii libcairo-gobject2 1.12.14-4 ii libcairo2 1.12.14-4 ii libcapi20-3 1:3.25+dfsg1-3.3 ii libcurl3-gnutls 7.31.0-2 ii libdbus-1-3 1.6.12-1 ii libdbus-glib-1-2 0.100.2-1 ii libebook-1.2-13 3.4.4-3 ii libedataserver-1.2-16 3.4.4-3 ii libgconf-2-4 3.2.6-1 ii libgdk-pixbuf2.0-0 2.28.2-1 ii libglib2.0-0 2.36.1-2build1 ii libgnome-keyring0 3.4.1-1 ii libgtk-3-0 3.4.2-6 ii libnotify4 0.7.5-2 ii libpango1.0-0 1.32.5-5+b1 ii libpulse0 2.0-6.1 ii libsndfile1 1.0.25-5 ii libsoup2.4-1 2.38.1-2 ii libspandsp2 0.0.6~pre20-3.1 ii libspeex1 1.2~rc1-7 ii libspeexdsp1 1.2~rc1-7 ii libxml2 2.9.1+dfsg1-2 ffgtk recommends no packages. ffgtk suggests no packages. -- no debconf information -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
