Your message dated Wed, 18 Mar 2015 11:14:10 +0000
with message-id <[email protected]>
and subject line Bug#780716: fixed in flightgear-data 3.0.0-3
has caused the Debian Bug report #780716,
regarding flightgear-data: nasal scripts can ready any file
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
780716: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780716
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: flightgear-data
Version: 3.0.0-1
Severity: grave
Tags: security
Upstream has reported two related security issues in how FlightGear
restricts what files Nasal (its built-in scripting language for
aircraft) can access.
This bug is tracking the portion related to the flightgear-data package.
-The allowed directories for reading include FG_SCENERY, which can be
changed from Nasal via /sim/terrasync/scenery-dir.
Effect: Can read any file as the user.
Fix: fgdata 60da2094252cee1a5cdfe737f29becd5c6800549
Regards
Markus Wanner
signature.asc
Description: OpenPGP digital signature
--- End Message ---
--- Begin Message ---
Source: flightgear-data
Source-Version: 3.0.0-3
We believe that the bug you reported is fixed in the latest version of
flightgear-data, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Markus Wanner <[email protected]> (supplier of updated flightgear-data package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 18 Mar 2015 10:43:34 +0100
Source: flightgear-data
Binary: flightgear-data-base flightgear-data-ai flightgear-data-aircrafts
flightgear-data-models flightgear-data-all fgfs-base fgfs-aircraft-base
fgfs-models-base fgfs-scenery-base
Architecture: source all
Version: 3.0.0-3
Distribution: unstable
Urgency: high
Maintainer: Debian FlightGear Crew <[email protected]>
Changed-By: Markus Wanner <[email protected]>
Description:
fgfs-aircraft-base - FlightGear aircraft data - transitional dummy package
fgfs-base - FlightGear base data - transitional dummy package
fgfs-models-base - FlightGear models data - transitional dummy package
fgfs-scenery-base - FlightGear scenery data - transitional dummy package
flightgear-data-ai - FlightGear Flight Simulator -- standard AI data
flightgear-data-aircrafts - FlightGear Flight Simulator -- standard aircraft
flightgear-data-all - FlightGear Flight Simulator - virtual package
flightgear-data-base - FlightGear Flight Simulator -- base files
flightgear-data-models - FlightGear Flight Simulator -- standard models
Closes: 780716
Changes:
flightgear-data (3.0.0-3) unstable; urgency=high
.
* Add patch 60da20.patch removing FG_SCENERY from the list of
allowed directories to disallow nasal scripts from reading any
file as the user. Closes: #780716.
Checksums-Sha1:
4f58ace126de0f035dcc8be3859e81942b16758c 3247 flightgear-data_3.0.0-3.dsc
2f0af21f3533fd586e5cf354423ec0ed614654af 6776
flightgear-data_3.0.0-3.debian.tar.xz
6b671731756c66ca87df56ead0730e7d3a64c2ad 565939394
flightgear-data-base_3.0.0-3_all.deb
fe36f390b2a51e475aa2e253624a84ceee729ed1 191278434
flightgear-data-ai_3.0.0-3_all.deb
81628f100e5557a55c65f360526c338d36cf1a79 151956316
flightgear-data-aircrafts_3.0.0-3_all.deb
c3aef65b2a1c157cf34f10e6df75699b6463162c 92812924
flightgear-data-models_3.0.0-3_all.deb
220b4f87fe83e74adff02fa858a880398506e544 5090
flightgear-data-all_3.0.0-3_all.deb
6d23e39b1f23b621c49c962457ef1213e1fc3332 5046 fgfs-base_3.0.0-3_all.deb
b2a38f922b5496e9a087ac70f348b2e374e35bd3 5058
fgfs-aircraft-base_3.0.0-3_all.deb
3af69f1cd088938c1ebc68b861aa8be576cda79e 5050 fgfs-models-base_3.0.0-3_all.deb
568c6f35103acd7c557a1de5c2e7a11407360351 5054 fgfs-scenery-base_3.0.0-3_all.deb
Checksums-Sha256:
faa9a15ed539ac9b80fe719565f4df692c251c57ad8d14b49b52b4ece5196997 3247
flightgear-data_3.0.0-3.dsc
f4a04f773d672bcf50c2ce8dfd24893ed5bffe4c2f39c91a204a81f1a61c6a4d 6776
flightgear-data_3.0.0-3.debian.tar.xz
19906d9258ab1d9766b59d682bfa0f494523f6393c4b29f94f363056aced9836 565939394
flightgear-data-base_3.0.0-3_all.deb
22b7595331bf6f6bb5961266ee3badd3618982d81872b61508c182d4cfacb327 191278434
flightgear-data-ai_3.0.0-3_all.deb
07815b7bcd887757e4e56a90e1d4c3f291229fe26637d2af9b826b6b44beb0d8 151956316
flightgear-data-aircrafts_3.0.0-3_all.deb
3e5368e52f97973cf36ad255d76a55a3707ae82641953ed4d169ded779ca8d5c 92812924
flightgear-data-models_3.0.0-3_all.deb
c2635dadc242af2639dfb38974644a57eadca36eb9011310733038fce7e9b272 5090
flightgear-data-all_3.0.0-3_all.deb
6d9efe2383321e7a08d11393754beb9d4484332373994d2f29d9321705388f43 5046
fgfs-base_3.0.0-3_all.deb
fcc116f1fb8ed7a0b6fddc6cf2f9c480853a130c68354589062f5c5cd14798d8 5058
fgfs-aircraft-base_3.0.0-3_all.deb
a6a41ce789a06622c6e772b87967c8a056932faec4af1c821e66a066e26f1c7a 5050
fgfs-models-base_3.0.0-3_all.deb
c268021b1969275cf03772fd9e686f354843c2f79f4e26d827b725ca49381e30 5054
fgfs-scenery-base_3.0.0-3_all.deb
Files:
cda98c51ddb76f0211edd86d288b9e6e 3247 games extra flightgear-data_3.0.0-3.dsc
ff97ec641a9033f6db6d190e74c801cb 6776 games extra
flightgear-data_3.0.0-3.debian.tar.xz
49d70c03bc9479acba8458f0c8b23fdb 565939394 games extra
flightgear-data-base_3.0.0-3_all.deb
f2634f73e2b5ee909726dff2a5eec658 191278434 games extra
flightgear-data-ai_3.0.0-3_all.deb
76588a9cf670a8ac8aec0dfb73e45bb2 151956316 games extra
flightgear-data-aircrafts_3.0.0-3_all.deb
1c66be38eaa65e2cbcd49cd1662a2017 92812924 games extra
flightgear-data-models_3.0.0-3_all.deb
2c8e02499d4905a1bd486778416c3e12 5090 games extra
flightgear-data-all_3.0.0-3_all.deb
ecfc462d4adf245da825e1e7afca6881 5046 oldlibs extra fgfs-base_3.0.0-3_all.deb
af9edfdd8283377810e3a85a2fa0b2cb 5058 oldlibs extra
fgfs-aircraft-base_3.0.0-3_all.deb
6db301b28e8cbea1a961fceb385ece4a 5050 oldlibs extra
fgfs-models-base_3.0.0-3_all.deb
a1dc12b2d76dfdf2bb1b97fb206e996e 5054 oldlibs extra
fgfs-scenery-base_3.0.0-3_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQQcBAEBCgAGBQJVCVWdAAoJEOhoLRs/MemzXZYgAOrbRRuBgoD9qVF2ZbD1q/OL
Son5x6s7siuMEQYYddG/laYYR+MoUB9qSZEaqE/RmOLJyBnLQoPkXu0xu2KtG7dX
psS+BPiH6XTEqiih9Ny5yyM0kdGg+YfS1/0x7VXLSxhigCJFv0QSdt0lUiDADndp
G9siG+t6FkfrH3GTiO9Aj6mPQIP6DUfkkL4hDPqaeBsG7r8EQOdhK7B3Yoe0uFZ7
iMuIHLyYyIkOUKbsSdS1aHNyuqDphl9+KbnlziECsIAlem54eALEECpdMgPdrqTJ
zcHNwVzhoX9672X44uSORHrsL3Qq7Tt2MFnSHZVLjnj+KbG38Buq8WhZnjbz7JVB
VsVdIcreIywYmvSghYqe+pvFyzJMNRFEYcPjVOFTN4pCrar7kYTfpBxoSFQPlm0S
S9654MIT+/Jxbyu1kcofG5Nu2nEEkz49uM5Zdw5pPzolP+52oXpsgEH/wuhEVzgE
ukz1nYGeBV0AGNPnL0tGqrm89XOP/5DCFvbmuDYcMa4WS4nnW5TQfWFCL2QxTlUK
HXmetcqPhSm0TIRU+OTaDebHa2S8FvQ15vmMrFPs07ojyOmFxkmav+6D0sxLmDoE
BQd4zukuQzeEP3yOr88efsRVANEhfLbxPA4yOJxYgIfYBzloageCZMRxpJY6D9rs
5UGAdY+4VjsiV7W9MXri5PiUgPB6q6ALcqoWKlbtE5Ze3ycyV2N14q+CtCmcMnSw
jxe0/lw4SZUy52q/FzgHreevGaVlmt5D0k6IoG/NRxsIfclVXxivWbTHgl6PKgZF
+8bDHC4M9PpFtfE940Bf8h41LcaMzfRYtl+OAh9a0WP8Pja6o2TYQk9AsQmJfFCJ
EEq0Rl2a0+9TbNA0iCzW6UePCx+7XFfh+rIYm/6Wpv+QhSsQKH/IO8Jv89YiddVk
gzw66m8s/Uhpd9TiacKlT330b+QcnsyNgbzTwPeWgAiGhuRmQK0geso2fPZNYOBj
4eLD3eWXcmBugpnlhsO1R7PrftWuLAGnyuGmAdorTc4+P6jqArxRxtPui7LLfY71
CchR3JFteScRSbLvDRmHAQMITYCVR0I8wy4MXLBETC4Tnva5UvYBO5dvNJc/Vz9t
zPrwttkvexTFsYxlpnb5KcA7HqGbXXxvlfdCzRd1YXt5v4DLvCa8rMVlQGCz4BpA
fQer6Z/Fkl3G5OFe4e9iP/kU7k/gDsYFHGQqR2h8WUk2+Pd7oxVnozuXcYKzSRfq
oFVrn7ns/ZCXuORM9DxziiencEIOyAM2QF3E4Ej7OSkhFIs3FG1fD0NaR+jec0zU
7T9XEySDCCLP7yjWwyRKTCqoI9SwCTJ6HLKLP5WQkSvWYrpJriiB0UjigfPkYVM=
=jypk
-----END PGP SIGNATURE-----
--- End Message ---
