CVE-2010-2056: Low severity gnu gv vulnerability

Paul Szabo reported: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583316#10

a deficiency in the way gv handled temporary file creation, when used for opening Portable Document Format (PDF) files. A local attacker could use this flaw to conduct symlink attacks, potentially leading to denial of service (un-athorized overwrite of file content).

References: [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=89;filename=004.diff;att=1;bug=583668 [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583668#100

Just for the record from [2]:

<begin quote>

This bug was fixed upstream in 3.6.5.90-1, the first version after lenny. :-(

Attached is a simplified version (without the configure changes as Debian has mkstemp) that should fix this in lenny.

Bernhard R. Link

<end quote>

and from [3]:

<begin quote>

Just for the records: In 3.6.5.90 (upstream) the configure-script was broken. Commit 73bb88a65dc1c6c9dc309b60b5454d9475cfccd9 repaired the defect (and changed other things):

--- a/gv/configure.ac +++ b/gv/configure.ac @@ -92,7 +92,7 @@ ACCHECKLIB(Xinerama, main, , , $XLIBS)

optmkstemp=false

-ACCHECKFUNCS([mkstemp],[optsetenvcode=true],[optsetenvcode=false]) +ACCHECKFUNCS([mkstemp],[optmkstemp=true],[optmkstemp=false]) AMCONDITIONAL(HAVEMKSTEMP, test x$optmkstemp = xtrue)

So the bugfix was disfunctional until configure.ac has been fixed. :-( And even worse: Nobody noticed that a rather long time.

<end quote>

— Red Hat