unofficial mirror of bug-gnu-emacs@gnu.org 
 help / color / mirror / code / Atom feed
From: David Bremner <bremner@unb.ca>
To: bug-gnu-emacs@gnu.org
Subject: bug#4291: 23.1; doc-view-mode temporary directory vulnerable to denial of service
Date: Sat, 29 Aug 2009 21:02:07 -0300	[thread overview]
Message-ID: <E1MhXrz-0005yJ-3B@localhost> (raw)


By default doc-view-mode makes a directory /tmp/docview$uid .  Since
this is easily predictable, a malicious person could cause docview to
fail simply by creating a directory with the same name. 

In GNU Emacs 23.1.1 (i486-pc-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2009-08-03 on raven, modified by Debian
Windowing system distributor `The X.Org Foundation', version 11.0.10603000
configured using `configure  '--build=i486-linux-gnu' '--host=i486-linux-gnu' '--prefix=/usr' '--sharedstatedir=/var/lib' '--libexecdir=/usr/lib' '--localstatedir=/var/lib' '--infodir=/usr/share/info' '--mandir=/usr/share/man' '--with-pop=yes' '--enable-locallisppath=/etc/emacs23:/etc/emacs:/usr/local/share/emacs/23.1/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/23.1/site-lisp:/usr/share/emacs/site-lisp:/usr/share/emacs/23.1/leim' '--with-x=yes' '--with-x-toolkit=athena' '--with-toolkit-scroll-bars' 'build_alias=i486-linux-gnu' 'host_alias=i486-linux-gnu' 'CFLAGS=-DDEBIAN -g -O2' 'LDFLAGS=-g' 'CPPFLAGS=''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_CA.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default-enable-multibyte-characters: t

Major mode: Fundamental

Minor modes in effect:
  diff-auto-refine-mode: t
  tool-bar-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  global-auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
M-x C-g C-x C-f t e a SPC c s SPC 2 SPC SPC w i SPC 
c SPC SPC SPC SPC <return> M-x r e p SPC o SPC SPC 
r SPC SPC SPC <return>

Recent messages:
Loading /home/bremner/.emacs-custom.el (source)...
Loading epa-mail...done
Loading /home/bremner/.emacs-custom.el (source)...done
Loading /usr/share/emacs/site-lisp/haskell-mode/haskell-site-file.el (source)...done
For information about GNU Emacs and the GNU system, type C-h C-a.
Quit
Making completion list... [2 times]
File mode specification error: (file-error "Doing chmod" "operation not permitted" "/tmp/docview1000")
Loading vc-git...done
Making completion list... [3 times]







             reply	other threads:[~2009-08-30  0:02 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2009-08-30  0:02 David Bremner [this message]
2009-08-31  1:42 ` bug#4291: 23.1; doc-view-mode temporary directory vulnerable to denial of service Glenn Morris
2009-08-31 14:55   ` Stefan Monnier
2009-09-01 21:15     ` Glenn Morris
2011-07-12 21:18     ` Lars Magne Ingebrigtsen
2011-07-12 21:44       ` Glenn Morris
2011-07-12 21:46         ` Lars Magne Ingebrigtsen
2011-07-12 22:16           ` Chong Yidong
2011-07-12 22:18             ` Lars Magne Ingebrigtsen
2011-07-16 19:38               ` Lars Magne Ingebrigtsen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://www.gnu.org/software/emacs/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=E1MhXrz-0005yJ-3B@localhost \
    --to=bremner@unb.ca \
    --cc=4291@emacsbugs.donarmstrong.com \
    --cc=bremner-dated-1252800134.2fccb3@pivot.cs.unb.ca \
    --cc=bug-gnu-emacs@gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/emacs.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).