On 16/06/2014 22:51, Sylvestre Ledru wrote: > On 19/04/2014 05:29, [email protected] wrote: >>> Jakub Wilk discovered that clang's scan-build utility insecurely handled >>> temporary files. >>> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744817 >>> The GetHTMLRunDir subroutine ... >>> 3) The function doesn't fail if the directory already exists, even if >>> it's owned by another user. >> Use CVE-2014-2893. >> > I think I fixed it upstream: > http://llvm.org/viewvc/llvm-project?view=revision&revision=211051 > http://llvm.org/viewvc/llvm-project/cfe/trunk/tools/scan-build/scan-build?r1=210971&r2=211051&pathrev=211051 > Actual patch fixed: http://llvm.org/viewvc/llvm-project/cfe/trunk/tools/scan-build/scan-build?r1=210971&r2=211053&pathrev=211053 Sorry about the noise
Sylvestre
signature.asc
Description: OpenPGP digital signature
