Re: Security fixes in m4-1.4.11

[Florian Weimer <fw () deneb enyo de>]

* Lubomir Kundrak:

> On Sun, 2008-04-06 at 20:42 -0400, Steven M. Christey wrote:
> > On Sun, 6 Apr 2008, Patrick J. Volkerding wrote:
> >
> > > Minor security fix: Quote output of mkstemp.
> >
> > Use CVE-2008-1687
>
> This does not sound like a security problem. Mkstemp would never output
> any shell metacharacters.

M4 performs macro expansion without any special characters present,
IIRC.  However, it's still unlikely that an mkstemp()-returned string
matches a macro, I think.