CVE request: yet another lighttpd issue

[Jonathan Smith <smithj () freethemallocs com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is another one of those only-with-strange-configuration issues. If
you enable mod_userdir and don't set userdir.path, it defaults to $HOME.
This can be undesirable, but especially so when you browse to a user
such as nobody, who has a homedir of /. Thus, folks can read any file on
the system.

Upstream ticket: http://trac.lighttpd.net/trac/ticket/1587
Fix (require that userdir.path be set):
http://trac.lighttpd.net/trac/changeset/2120?format=diff&new=2120
rPath issue: https://issues.rpath.com/browse/RPL-2344#action_51691
Gentoo bug: https://bugs.gentoo.org/show_bug.cgi?id=212930

        smithj

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.8 (GNU/Linux)

iEYEARECAAYFAkfVNFcACgkQCG91qXPaRelLGQCfUGob1qal/OLZsmKterBepfuN
OPkAoK0XBj92rLKEURDaLTebgChD6IK5
=rzz7
-----END PGP SIGNATURE-----