Re: CVE request: patch directory traversal flaw

[Dan Rosenberg <dan.j.rosenberg () gmail com>]

Be sure to be careful while applying the patch to fix this one. :p

-Dan

On Wed, Jan 5, 2011 at 4:54 PM, Vincent Danen <vdanen () redhat com> wrote:
> We got a heads up on a directory traversal flaw in patch.  I don't think
> a CVE name has been assigned to it; could we get one?  It allows for the
> creation of arbitrary files in unexpected places due to the use of '..'.
>
> References:
>
> https://bugzilla.redhat.com/show_bug.cgi?id=667529
> http://osdir.com/ml/bug-patch-gnu/2010-12/msg00000.html
>
> Thanks.
>
> --
> Vincent Danen / Red Hat Security Response Team