Re: caml-light insecure temporary files

[Florian Weimer <fw () deneb enyo de>]

* David Holland:

> I don't know if anyone besides us still ships caml-light; it is long
> dead upstream and obsoleted by ocaml. AFAICT neither Debian nor Red
> Hat does. But just in case: it uses mktemp() insecurely, and also does
> unsafe things in /tmp during make install.

Moscow ML includes a copy of the affected code, and it's perhaps less
obsolete than caml-light.  It seems to be part of the FreeBSD ports
collection.