From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail1.windriver.com (mail1.windriver.com [147.11.146.13]) by mail.openembedded.org (Postfix) with ESMTP id 40FF76023F for ; Tue, 18 Jun 2013 02:28:50 +0000 (UTC) Received: from ALA-HCB.corp.ad.wrs.com (ala-hcb.corp.ad.wrs.com [147.11.189.41]) by mail1.windriver.com (8.14.5/8.14.3) with ESMTP id r5I2Sqa0029196 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Mon, 17 Jun 2013 19:28:52 -0700 (PDT) Received: from pek-hostel-vm12.wrs.com (128.224.153.182) by ALA-HCB.corp.ad.wrs.com (147.11.189.41) with Microsoft SMTP Server id 14.2.342.3; Mon, 17 Jun 2013 19:28:51 -0700 From: To: Date: Mon, 17 Jun 2013 22:28:49 -0400 Message-ID: X-Mailer: git-send-email 1.7.9.5 MIME-Version: 1.0 Subject: [PATCH 0/1] logrotate: fix for CVE-2011-1548 X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Patches and discussions about the oe-core layer List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jun 2013 02:28:51 -0000 Content-Type: text/plain From: Wenzong Fan If a logfile is a symlink, it may be read when being compressed, being copied (copy, copytruncate) or mailed. Secure data (eg. password files) may be exposed. Portback nofollow.patch from: http://logrotate.sourcearchive.com/downloads/3.8.1-5/logrotate_3.8.1-5.debian.tar.gz The following changes since commit 1dd643b142c69ac9035e29bff11d02201638dc65: licences: Add SGI license (2013-06-17 16:45:37 +0100) are available in the git repository at: git://git.pokylinux.org/poky-contrib wenzong/logrotate http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/logrotate Wenzong Fan (1): logrotate: fix for CVE-2011-1548 .../logrotate-3.8.1/logrotate-CVE-2011-1548.patch | 43 ++++++++++++++++++++ meta/recipes-extended/logrotate/logrotate_3.8.1.bb | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta/recipes-extended/logrotate/logrotate-3.8.1/logrotate-CVE-2011-1548.patch -- 1.7.9.5