libdata-uuid-perl: CVE-2013-4184: symlink attacks vulnerability

Debian Bug report logs - #718949
libdata-uuid-perl: CVE-2013-4184: symlink attacks vulnerability

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libdata-uuid-perl: CVE-2013-4184: symlink attacks vulnerability

Date: Wed, 07 Aug 2013 08:02:50 +0200

Package: libdata-uuid-perl
Version: 1.219-1
Severity: important
Tags: security upstream

Hi

CVE-2013-4184 was assigned to a symlink attack vulnerability for
Data::UUID. See 

 http://marc.info/?l=oss-security&m=137525838315067&w=2

and

 https://github.com/rjbs/Data-UUID/issues/5

Regards,
Salvatore

Message #16 received at 718949@bugs.debian.org (full text, mbox, reply):

From: Damyan Ivanov <dmn@debian.org>

To: 718949@bugs.debian.org

Subject: #718949 -- libdata-uuid-perl: CVE-2013-4184: symlink attacks vulnerability

Date: Fri, 3 Nov 2017 13:32:01 +0000

[Message part 1 (text/plain, inline)]

Control: tag -1 patch

I have a (rather crude) patch that removes save/retrieval of 
state/node info to files. The test suite seems to pass.

Not sure whether we shall seek to remove libdata-uuid-perl instead.
There are libuuid-perl and  libossp-uuid-perl which seem like suitable 
replacement.

DAK check shows three affected packages:

# Broken Depends:
libcatmandu-perl: libcatmandu-perl
libkiokudb-perl: libkiokudb-perl
zoneminder: zoneminder [amd64 arm64 armel armhf i386 kfreebsd-amd64 kfreebsd-i386 mips mips64el mipsel powerpc ppc64el s390x]

# Broken Build-Depends:
libcatmandu-perl: libdata-uuid-perl
libkiokudb-perl: libdata-uuid-perl


Cheers,
    dam

[cve-2013-4184.patch (text/x-diff, attachment)]

Send a report that this bug log contains spam.