From mboxrd@z Thu Jan  1 00:00:00 1970
Path: news.gmane.org!not-for-mail
From: Florian Weimer <fw@deneb.enyo.de>
Newsgroups: gmane.emacs.devel,gmane.emacs.gnus.general
Subject: Re: Security flaw in pgg-gpg-process-region?
Date: Sun, 03 Sep 2006 18:28:35 +0200
Message-ID: <87ac5gnccs.fsf@mid.deneb.enyo.de>
References: <b4maca88q6i.fsf@jpl.org>
	<def1aabc-69b9-4b1d-bb84-e65c63540eac@well-done.deisui.org>
	<b4mmze82cse.fsf@jpl.org> <b4mwtdbfqob.fsf@jpl.org>
	<9c79059a-61a9-4fa4-8376-638753320a14@well-done.deisui.org>
	<b4mpsj3gw1s.fsf@jpl.org> <b4my7xrfg5o.fsf@jpl.org>
	<4aaf7080-0e3d-4a75-aff5-f9d5bcd0437f@well-done.deisui.org>
	<87fyjz2gaj.fsf@pacem.orebokech.com>
	<v9iroj49cz.fsf@marauder.physik.uni-ulm.de>
	<v9mz9itt6y.fsf_-_@marauder.physik.uni-ulm.de>
NNTP-Posting-Host: main.gmane.org
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Trace: sea.gmane.org 1157300944 16038 80.91.229.2 (3 Sep 2006 16:29:04 GMT)
X-Complaints-To: usenet@sea.gmane.org
NNTP-Posting-Date: Sun, 3 Sep 2006 16:29:04 +0000 (UTC)
Cc: Simon Josefsson <jas@extundo.com>, Daiki Ueno <ueno@unixuser.org>,
	Satyaki Das <satyaki@chicory.stanford.edu>, ding@gnus.org,
	emacs-devel@gnu.org
Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Sun Sep 03 18:29:02 2006
Return-path: <emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org>
Envelope-to: ged-emacs-devel@m.gmane.org
Original-Received: from lists.gnu.org ([199.232.76.165])
	by ciao.gmane.org with esmtp (Exim 4.43)
	id 1GJuqE-0005D1-3u
	for ged-emacs-devel@m.gmane.org; Sun, 03 Sep 2006 18:29:02 +0200
Original-Received: from localhost ([127.0.0.1] helo=lists.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43)
	id 1GJuqD-0006E7-Lz
	for ged-emacs-devel@m.gmane.org; Sun, 03 Sep 2006 12:29:01 -0400
Original-Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1GJuq2-0006Ds-Ma
	for emacs-devel@gnu.org; Sun, 03 Sep 2006 12:28:50 -0400
Original-Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1GJupz-0006Dg-W3
	for emacs-devel@gnu.org; Sun, 03 Sep 2006 12:28:49 -0400
Original-Received: from [199.232.76.173] (helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1GJupz-0006Dd-O3
	for emacs-devel@gnu.org; Sun, 03 Sep 2006 12:28:47 -0400
Original-Received: from [212.9.189.167] (helo=mail.enyo.de)
	by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA:32)
	(Exim 4.52) id 1GJv0K-0001Sr-4W
	for emacs-devel@gnu.org; Sun, 03 Sep 2006 12:39:28 -0400
Original-Received: from deneb.vpn.enyo.de ([212.9.189.177] helo=deneb.enyo.de)
	by mail.enyo.de with esmtp id 1GJups-0004HE-JU;
	Sun, 03 Sep 2006 18:28:40 +0200
Original-Received: from fw by deneb.enyo.de with local (Exim 4.62)
	(envelope-from <fw@deneb.enyo.de>)
	id 1GJupn-0002IR-QG; Sun, 03 Sep 2006 18:28:35 +0200
Original-To: Reiner Steib <Reiner.Steib@gmx.de>
In-Reply-To: <v9mz9itt6y.fsf_-_@marauder.physik.uni-ulm.de> (Reiner Steib's
	message of "Sat, 02 Sep 2006 13:16:05 +0200")
X-BeenThere: emacs-devel@gnu.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Emacs development discussions." <emacs-devel.gnu.org>
List-Unsubscribe: <http://lists.gnu.org/mailman/listinfo/emacs-devel>,
	<mailto:emacs-devel-request@gnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/emacs-devel>
List-Post: <mailto:emacs-devel@gnu.org>
List-Help: <mailto:emacs-devel-request@gnu.org?subject=help>
List-Subscribe: <http://lists.gnu.org/mailman/listinfo/emacs-devel>,
	<mailto:emacs-devel-request@gnu.org?subject=subscribe>
Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org
Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org
Xref: news.gmane.org gmane.emacs.devel:59285 gmane.emacs.gnus.general:63637
Archived-At: <http://permalink.gmane.org/gmane.emacs.devel/59285>

* Reiner Steib:

> In current Emacs CVS in fact `call-process-region' uses temp files.
> Bad.  I think this is a severe security problem, isn't it?

Why?  AFAICS, Emacs uses mkstemp when available, which should get the
permissions right.