Bug#507465: mb2md often misses message boundaries in mbox files

2008-12-03 Thread Bruno De Fraine
Hello, This script intentionally looks for a blank line in between messages in the mbox file. There is no such requirement that I know of; There *is* certainly mention of a blank line in the first few references that turn up when looking for an mbox file specification:

Bug#503645: jhead: CVE-2008-4640, CVE-2008-4641 command injection via filename and insecure file handling

2008-11-04 Thread Bruno De Fraine
Hello Matthias, On 3-nov-08, at 16:04, Matthias Wandel wrote: Ok, I have integrated this patch, plus a temp file patch that was submitted, and uploaded it as the head rev copy on the website. The head rev version number has been changed to 2.85. I have made sure it works under Windows,

Bug#503645: jhead: CVE-2008-4640, CVE-2008-4641 command injection via filename and insecure file handling

2008-10-30 Thread Bruno De Fraine
Hello, After looking at the documentation of my shell, I propose the following patch for the command injection problem. (I assume this works for other Unix shells as well.) Demo with some maliciously crafted file names: $ ./jhead -cmd ls i foo.jpg* Cmd:ls foo.jpg\`date\` foo.jpg`date`

Bug#503645: jhead: CVE-2008-4640, CVE-2008-4641 command injection via filename and insecure file handling

2008-10-29 Thread Bruno De Fraine
this would be sufficient to rule out the vulnerability? Best regards, Bruno De Fraine -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]