oss-sec mailing list archives
CVE Request: click
From: Jamie Strandboge <jamie () canonical com>
Date: Mon, 11 Jan 2016 11:42:30 -0600
Hi MITRE, all, A vulnerability was discovered in the click package system: https://launchpad.net/bugs/1506467 http://www.ubuntu.com/usn/usn-2771-1/ It was fixed in 0.4.42 with: https://code.launchpad.net/~cjwatson/click/audit-missing-dot-slash/+merge/274554 This is an input sanitization bug where click assumed leading paths were always prefixed with './' which, for example, allows a crafted click to ship a '.click' directory to manipulate the click install process. Can we get a CVE for this? Thanks! -- Jamie Strandboge http://www.ubuntu.com/
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- CVE Request: click Jamie Strandboge (Jan 11)
- Re: CVE Request: click Jamie Strandboge (Jan 12)
- Re: CVE Request: click cve-assign (Jan 12)