[gentoo-announce] GLSA: semi (200308-02)

[gentoo-announce] GLSA: semi (200308-02)

[Daniel Ahlberg]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1377 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200308-02
- - - ---------------------------------------------------------------------

          PACKAGE : semi
          SUMMARY : insecure temporary files creation
             DATE : 2003-08-14 19:30 UTC
          EXPLOIT : local
VERSIONS AFFECTED : <semi-1.14.5-r1
    FIXED VERSION : >=semi-1.14.5-r1
              CVE : CAN-2003-0440

- - - ---------------------------------------------------------------------

quote from CVE: 

"The (1) semi MIME library 1.14.5 and earlier, and (2) wemi 1.14.0 and 
possibly other versions, allows local users to overwrite arbitrary files 
via a symlink attack on temporary files."

SOLUTION

It is recommended that all Gentoo Linux users who are running
app-emacs/semi upgrade to semi-1.14.5-r1 as follows

emerge sync
emerge semi
emerge clean

- - - ---------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at http://dev.gentoo.org/~aliz
usata@gentoo.org
- - - ---------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/O+NVfT7nyhUpoZMRAlo0AJ0ZwAWeNbss87RYJ5UaSvHXkF3n7wCfbZTw
eDaHCxhEc1WGSEoQpcL+/J8=
=ThD4
-----END PGP SIGNATURE-----