Re: CVE id request: Debian/Ubuntu specific issue in xvfb-run (xorg)

[Nico Golde <oss-security+ml () ngolde de>]

Hi,
* Nico Golde <oss-security+ml () ngolde de> [2009-05-05 17:18]:
> can I get a CVE id for http://bugs.debian.org/526678
>
> The xvfb-run script used in Debian insecurely passes the X 
> magic cookie via the commandline so it's an easy thing to 
> grab it with system access.

YFYI, our maintainer just told me that he thinks this is included 
since Fedora 10 in Fedora as well...

Cheers
Nico
-- 
Nico Golde - http://www.ngolde.de - nion () jabber ccc de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

Attachment: _bin
Description: