Re: CVE request: jhead

[Tomas Hoger <thoger () redhat com>]

On Thu, 27 Nov 2008 00:21:54 +0100 Robert Buchholz <rbu () gentoo org>
wrote:

> These two issues have been resolved in the current
> "jhead-latest.tar.gz" distributed on the upstream site. Both Ubuntu
> and Debian have renamed one version of this file to be "2.85" whereas
> upstream has not yet released any 2.85 version. Upstream stated that
> they will release a 2.85 not before next year, so anyone who has this
> issue open can either extract patches, package the snapshot or wait.

Looks like -latest tarball was updated again and now mentions 2.86
inside.  In that, usage of mkstemp was replaced with mktemp (previous
version failed to close file descriptors opened by mkstemp, probably
causing issues when trying to use command on large pile of images at
once).  Those the temp file seem to be created user-specified
destination directory, probably not too likely to be /tmp (and hence
prone to races).

Anyway, can anyone help me understand what was CVE-2008-4639 assigned
to?  I tried looking at the diff between 2.7 and 2.84 and fail to see
any relevant change...

-- 
Tomas Hoger / Red Hat Security Response Team