Bug#598424: Patch for CVE-2010-3394

2010-12-08 Thread Jakub Wilk
* Etienne Millon , 2010-11-25, 20:35: $ LD_LIBRARY_PATH= $ LD_LIBRARY_PATH="/foobar${LD_LIBRARY_PATH+":$LD_LIBRARY_PATH"}" $ echo $LD_LIBRARY_PATH /foobar: LD_LIBRARY_PATH can be unset "naturally", ie without the user knowing. It is actually the default. However, if it evaluates to the empty str

Bug#598424: Patch for CVE-2010-3394

2010-11-25 Thread Etienne Millon
On Thu, Nov 25, 2010 at 05:58:18PM +0100, Moritz Muehlenhoff wrote: > On Sun, Nov 14, 2010 at 02:11:47PM +0100, Jakub Wilk wrote: > > found 598424 1:1.0.7.4-3 > > thanks > > > > * Etienne Millon , 2010-10-20, 09:44: > >> It does, indeed. On line 30 of /usr/bin/texmacs, the inclusion of > >> "$TEXMA

Bug#598424: Patch for CVE-2010-3394

2010-11-25 Thread Moritz Muehlenhoff
On Sun, Nov 14, 2010 at 02:11:47PM +0100, Jakub Wilk wrote: > found 598424 1:1.0.7.4-3 > thanks > > * Etienne Millon , 2010-10-20, 09:44: >> It does, indeed. On line 30 of /usr/bin/texmacs, the inclusion of >> "$TEXMACS_BIN_PATH/lib" is properly done, because : >> >> - if LD_LIBRARY_PATH is empty

Processed: Re: Bug#598424: Patch for CVE-2010-3394

2010-11-14 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: > found 598424 1:1.0.7.4-3 Bug #598424 {Done: Atsuhito KOHDA } [texmacs] texmacs: CVE-2010-3394: insecure library loading Bug Marked as found in versions texmacs/1:1.0.7.4-3; no longer marked as fixed in versions texmacs/1:1.0.7.4-3 and reopened.

Bug#598424: Patch for CVE-2010-3394

2010-11-14 Thread Jakub Wilk
found 598424 1:1.0.7.4-3 thanks * Etienne Millon , 2010-10-20, 09:44: It does, indeed. On line 30 of /usr/bin/texmacs, the inclusion of "$TEXMACS_BIN_PATH/lib" is properly done, because : - if LD_LIBRARY_PATH is empty before, the ${LD_LIBRARY_PATH+...} constructs evaluates to the empty

Bug#598424: Patch for CVE-2010-3394

2010-10-20 Thread Atsuhito Kohda
Hi Etienne, On Wed, 20 Oct 2010 09:44:56 +0200, Etienne Millon wrote: >> Does the following sentence relate to my question? >> >> > I believe that the second warning can be >> > safely ignored. > > It does, indeed. On line 30 of /usr/bin/texmacs, the inclusion of > "$TEXMACS_BIN_PATH/lib" is pr

Bug#598424: Patch for CVE-2010-3394

2010-10-20 Thread Atsuhito Kohda
Hi all, sorry for delay. On Fri, 15 Oct 2010 09:51:07 +0200, Etienne Millon wrote: > Here is a patch that fixes this issue. I believe that the second warning can > be > safely ignored. I'm preparing a fixed package but I've a question which I' like to solve before upload it. A patch of Etienne

Bug#598424: Patch for CVE-2010-3394

2010-10-20 Thread Etienne Millon
Hello, > Does the following sentence relate to my question? > > > I believe that the second warning can be > > safely ignored. It does, indeed. On line 30 of /usr/bin/texmacs, the inclusion of "$TEXMACS_BIN_PATH/lib" is properly done, because : - if LD_LIBRARY_PATH is empty before, the ${LD

Bug#598424: Patch for CVE-2010-3394

2010-10-15 Thread Etienne Millon
tags 598424 patch thanks Dear maintainer, Here is a patch that fixes this issue. I believe that the second warning can be safely ignored. Regards, -- Etienne Millon diff -u texmacs-1.0.7.4/debian/changelog texmacs-1.0.7.4/debian/changelog --- texmacs-1.0.7.4/debian/changelog +++ texmacs-1.0.7.