Your message dated Mon, 06 Nov 2006 22:02:13 -0800 with message-id <[EMAIL PROTECTED]> and subject line Bug#396949: fixed in lynx-cur 2.8.7dev2-1 has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what I am talking about this indicates a serious mail system misconfiguration somewhere. Please contact me immediately.) Debian bug tracking system administrator (administrator, Debian Bugs database)
--- Begin Message ---Package: lynx-cur Version: 2.8.7dev1-1 Severity: grave Tags: security Justification: user security hole Lynx attempts to use the .mime.types and .mailcap files located in the current directory: $ strace lynx -dump 2>&1 | grep '^open("[^/]' open(".mailcap", O_RDONLY) = -1 ENOENT (No such file or directory) open(".mime.types", O_RDONLY) = -1 ENOENT (No such file or directory) $ This allows an attacker to cause lynx to execute arbitrary shell code when a user runs lynx while visiting a directory with attacker-provided contents. -- System Information: Debian Release: testing/unstable APT prefers testing APT policy: (500, 'testing') Architecture: i386 (x86_64) Shell: /bin/sh linked to /bin/dash Kernel: Linux 2.6.18 Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8) Versions of packages lynx-cur depends on: ii debconf [debconf-2.0] 1.5.8 Debian configuration management sy ii libc6 2.3.6.ds1-4 GNU C Library: Shared libraries ii libgnutls13 1.4.4-1 the GNU TLS library - runtime libr ii libncursesw5 5.5-5 Shared libraries for terminal hand ii zlib1g 1:1.2.3-13 compression library - runtime Versions of packages lynx-cur recommends: ii mime-support 3.37-1 MIME files 'mime.types' & 'mailcap -- debconf information: * lynx-cur/defaulturl: http://www.google.pl/ lynx-cur/etc_lynx.cfg:
--- End Message ---
--- Begin Message ---Source: lynx-cur Source-Version: 2.8.7dev2-1 We believe that the bug you reported is fixed in the latest version of lynx-cur, which is due to be installed in the Debian FTP archive: lynx-cur-wrapper_2.8.7dev2-1_all.deb to pool/main/l/lynx-cur/lynx-cur-wrapper_2.8.7dev2-1_all.deb lynx-cur_2.8.7dev2-1.diff.gz to pool/main/l/lynx-cur/lynx-cur_2.8.7dev2-1.diff.gz lynx-cur_2.8.7dev2-1.dsc to pool/main/l/lynx-cur/lynx-cur_2.8.7dev2-1.dsc lynx-cur_2.8.7dev2-1_i386.deb to pool/main/l/lynx-cur/lynx-cur_2.8.7dev2-1_i386.deb lynx-cur_2.8.7dev2.orig.tar.gz to pool/main/l/lynx-cur/lynx-cur_2.8.7dev2.orig.tar.gz A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [EMAIL PROTECTED], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Atsuhito KOHDA <[EMAIL PROTECTED]> (supplier of updated lynx-cur package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [EMAIL PROTECTED]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.7 Date: Tue, 7 Nov 2006 14:11:36 +0900 Source: lynx-cur Binary: lynx-cur-wrapper lynx-cur Architecture: source i386 all Version: 2.8.7dev2-1 Distribution: unstable Urgency: low Maintainer: Atsuhito KOHDA <[EMAIL PROTECTED]> Changed-By: Atsuhito KOHDA <[EMAIL PROTECTED]> Description: lynx-cur - Text-mode WWW Browser with NLS support (development version) lynx-cur-wrapper - Wrapper for lynx-cur Closes: 396949 Changes: lynx-cur (2.8.7dev2-1) unstable; urgency=low . * New Upstream Release. - modify logic for reading PERSONAL_EXTENSION_MAP and PERSONAL_MAILCAP to ensure that they are files that are controlled only by the user. The default values for these allow lynx to read configuration information from the user's current directory at lynx's startup (Closes: #396949) * Modified makefile.in slightly in order not scare people. Files: 362f3e2c70b6f21be9fb3bb5aa4dd4b7 672 web extra lynx-cur_2.8.7dev2-1.dsc e6aa5e07ce84ff56557bfcda48661274 3188009 web extra lynx-cur_2.8.7dev2.orig.tar.gz 5dd2acfba248121d16b5ba481aa78025 24674 web extra lynx-cur_2.8.7dev2-1.diff.gz 4f65fdc4c7ff1f4ff905aecbbcf22135 14550 web extra lynx-cur-wrapper_2.8.7dev2-1_all.deb addffe213669b44b3ab31f6ce9e3065b 1964948 web extra lynx-cur_2.8.7dev2-1_i386.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFUB7n1IXdL1v6kOwRAngUAJsGxU+XDSMb/ZEHtIxb6kPUrTIdRwCeJy8D CkQrLtvhL0OqPp4K1zgQYVw= =fTFe -----END PGP SIGNATURE-----
--- End Message ---
