#33150 [Com]: shtool php insecure temporary file creation

From: Date: Fri, 10 Jun 2005 15:18:21 +0000
Subject: #33150 [Com]: shtool php insecure temporary file creation
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-80130@lists.php.net to get a copy of this message 
 ID:               33150
 Comment by:       koon at gentoo dot org
 Reported By:      eromang at zataz dot net
 Status:           Assigned
 Bug Type:         Compile Failure
 Operating System: UNIX
 PHP Version:      5.*, 4.*
 Assigned To:      sniper
 New Comment:

Apparently PHP only uses the mkdir and echo commands, neither makes a
tmpfile. SO you probably aren't affected by this currently.


Previous Comments:
------------------------------------------------------------------------

[2005-05-30 01:02:05] sniper@php.net

We'll update the bundled shtool as soon as they release new version of
it. We will not start patching it ourselves.



------------------------------------------------------------------------

[2005-05-29 22:25:54] eromang at zataz dot net

Hello,

Here under the patch proposal from Gentoo Security Team.

https://bugs.gentoo.org/attachment.cgi?id=60117

CAN-2005-1751

Regards.

------------------------------------------------------------------------

[2005-05-26 13:43:40] eromang at zataz dot net

Description:
------------
Hello,

php is using a vulnerable version of shtool.

For more informations :

http://www.securityfocus.com/bid/13767?ref=rss

Regards



------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=33150&edit=1

Thread (9 messages)

« previous php.bugs (#80130) next »