An Ubuntu security advisory fixed a temporary file vulnerability in the run-mozilla.sh script when run in debug mode. The run-mozilla.sh script passes gdb arguments from a temporary file which is named in a manner that makes it fairly easy to guess. The temporary file should be created using the mktemp program to ensure proper file permissions and a unique filename.
Created attachment 192382 [details] [diff] [review] Suggested fix for this issue
Different patch was originally submitted by the author of the original bug : http://bugs.debian.org/cgi-bin/bugreport.cgi/mozilla-thunderbird-1.0.diff?bug=306893;msg=5;att=1
Nominating for a closer look based on Frederic's mail.
Is the patch effective? Running out of time for 1.5b2 . ..
DBaron - need SR here.
Comment on attachment 192382 [details] [diff] [review] Suggested fix for this issue This patch doesn't actually work because of the spaces around the equals sign in this line: >+ mozargs_temp = `mktemp /tmp/mozargs.XXXXXX` If you fix that, then it works, so sr=dbaron, conditional on removing those two spaces.
That said, I think the patch in comment 2 is preferable (except with the whitespace cleaned up), both because it uses mktemp -t and because it removes the temporary file under more conditions.
Comment on attachment 192382 [details] [diff] [review] Suggested fix for this issue please re-request approval when you've got a fully reviewed patch.
Dbaron, can you get that earlier patch in? This bug is stalled and we seem to want it for beta2.
(In reply to comment #9) > Dbaron, can you get that earlier patch in? This bug is stalled and we seem to > want it for beta2. I was actually about to check this in
fix checked into trunk
Note: RH7.3 doesn't have mktemp -t
dropped -t and went back to mktemp /tmp/mozargs.XXXXXX fix checked into the 1.8 branch
Any hope to get it landed on on 1.0.x aviary branch too ?
or
