Debian: DSA-022-1 Moderate: Exmh Local Tempfile Symlink Risk

Former versions of the exmh program used /tmp for storing temporary
files. No checks were made to ensure that nobody placed a symlink
with the same name in /tmp in the meantime and thus was vulnerable to
a symlink attack. This could lead to a malicious local user being
able to overwrite any file writable by the user executing exmh.
Upstream developers have reported and fixed this. The exmh program
now use /tmp/login now unless TMPDIR or EXMHTMPDIR is set.

We recommend you upgrade your exmh packages immediately.

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 2.2 alias potato

Potato was released for the alpha, arm, i386, m68k, powerpc and
sparc architectures. This package does not contain any architecture
dependent data (i.e. no compiled programs).


Source archives:


MD5 checksum: 67cd5c52498b1dc120b608b151cbd44c
...