Stay Secure with the Latest Linux Advisories

security advisorydebianlocal issue

Debian: DSA 337-1 Moderate: Insecure File Management in Semi and Wemi

semi, a MIME library for GNU Emacs, does not take appropriate security precautions when creating temporary files.. - -------------------------------------------------------------------------- Debian Security Advisory DSA 337-1 This email address is being protected from spambots. You need JavaScript enabled to view it. Debian -- Security Information Matt Zimmerman July 6th, 2003 Debian -- Debian security FAQ - -------------------------------------------------------------------------- Package : semi, wemi Vulnerability : insecure temporary file Problem-Type : local Debian-specific: no CVE Ids : CAN-2003-0440 semi, a MIME library for GNU Emacs, does not take appropriate security precautions when creating temporary files. This bug could potentially be exploited to overwrite arbitrary files with the privileges of the user running Emacs and semi, potentially with contents supplied by the attacker. wemi is a fork of semi, and contains the same bug. For the stable distribution (woody) this problem has been fixed in semi version 1.14.3.cvs.2001.08.10-1woody2 and wemi version 1.14.0.20010802wemiko-1.3. For the unstable distribution (sid) this problem has been fixed in semi version 1.14.5+20030609-1. The unstable distribution does not contain a wemi package. We recommend that you update your semi and wemi packages. Upgrade Instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - -------------------------------- Source archives: Size/MD5 checksum: 620 3949b7a3bc726a8f96b24adf5c965e37 Size/MD5 checksum: 20481abd8c72197b6fc901c454247d8750ea4 Size/MD5 checksum: 134788 2f0dd2581b1350a0a5249bb6c8ea18f0 Size/MD5 checksum: 630 a0dfbca5275f27cbf0a5849390c15a25 Size/MD5 checksum: 29933 23b2c6e66f69683c4892d7ac16ff7337 Size/MD5 checksum: 138332 e58f2eda9401df7493584e7f064b2ed1 Architecture independent components: Size/MD5 checksum: 175496 73a1be04f4457ae6c92e487dc42c09d0 Size/MD5 checksum: 173030 241fc879552c26a4a8a62b9874adaab0 These files will probably be moved into the stable distribution on its next revision. - --------------------------------------------------------------------------------- For apt-get: deb Debian -- Security Information stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. Package info: `apt-cache show ' and https://www.debian.org/distrib/packages . Debian advisory highlights an insecure file handling risk in Semi and Wemi, prompt software updates are advised.. Debian Security Advisory, Insecure File Handling, Semi Package Update. . LinuxSecurity.com Team

Jul 07, 2003 Debian