| Summary: | perl-Capture-Tiny new security issue CVE-2014-1875 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | jquelin, mageia, napcok, rverschelde, sysadmin-bugs, tmb |
| Version: | 4 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/586337/ | ||
| Whiteboard: | MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK advisory | ||
| Source RPM: | perl-Capture-Tiny-0.210.0-2.mga3.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2014-02-07 17:01:40 CET
David Walser
2014-02-07 17:01:49 CET
Whiteboard:
(none) =>
MGA4TOO, MGA3TOO Cauldron updated to latest version. MGA4 and MGA3 patched and submitted. David, I hope you take care of the rest :) CC:
(none) =>
mageia Yes, thanks Sander! Advisory: ======================== Updated perl-Capture-Tiny packages fix security vulnerability: perl-Capture-Tiny before 0.24 used files in /tmp in an insecure manner (CVE-2014-1875). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1875 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737835 ======================== Updated packages in core/updates_testing: ======================== perl-Capture-Tiny-0.210.0-2.1.mga3 perl-Capture-Tiny-0.220.0-2.1.mga4 from SRPMS: perl-Capture-Tiny-0.210.0-2.1.mga3.src.rpm perl-Capture-Tiny-0.220.0-2.1.mga4.src.rpm CC:
(none) =>
jquelin Testing complete on Mageia 3 and Mageia 4 i586.
Testing procedure, save this script as tiny.pl:
######################
use Capture::Tiny ':all';
$cmd = "/usr/bin/ls";
@args = @ARGV;
($stdout, $stderr, $exit) = capture {
system($cmd, @args);
};
print "STDOUT\n";
print $stdout;
print "STDERR\n";
print $stderr;
print "EXIT: ";
print $exit . "\n";
#######################
Then you can use the script just like the ls command, and it will print out the standard output, error, and exit status all neatly sorted out. I ran it in a directory that had a file FC4.txt but no file called oof.
$ perl tiny.pl oof FC4.txt
STDOUT
FC4.txt
STDERR
/usr/bin/ls: cannot access oof: No such file or directory
EXIT: 512
$ perl tiny.pl FC4.txt
STDOUT
FC4.txt
STDERR
EXIT: 0
$Whiteboard:
MGA3TOO =>
MGA3TOO has_procedure MGA3-32-OK MGA4-32-OK Testing complete on Mageia 4 x86_64. CC:
(none) =>
napcok Testing complete on Mageia 3 x86_64 following the procedure in comment 3. Validating update. Advisory has been uploaded, please push to 3 & 4 core/updates. Keywords:
(none) =>
validated_update Update pushed: http://advisories.mageia.org/MGASA-2014-0068.html Status:
NEW =>
RESOLVED
David Walser
2014-02-14 18:52:58 CET
URL:
(none) =>
http://lwn.net/Vulnerabilities/586337/ |