Re: CVE request - pdfjam

[Robert Buchholz <rbu () gentoo org>]

On Friday 19 December 2008, Tomas Hoger wrote:
> Hi!
>
> Insecure temporary file handling flaw was reported for pdfjam:
>
> https://bugzilla.novell.com/show_bug.cgi?id=459031
>
> Issue affects all 3 scripts shipped in pdfjam: pdf90, pdfjoin and
> pdfnup
>
> They create various temporary files in tempfileDir (/var/tmp),
> process id ($$) is used for file name uniqueness.

Martin Väth also discovered an untrusted search path vulnerability in 
the pdfjam scripts: They prepend . to PATH, allowing attackers to 
execute code by preparing executables (e.g. sed) in the directory 
pdfnup was run from or in /var/tmp (e.g. pdflatex, cp, rm).

Martin also prepared a patch, see:
https://bugs.gentoo.org/show_bug.cgi?id=252734

Please assign another CVE for this issue.

Robert

Attachment: signature.asc
Description: This is a digitally signed message part.