diff -Nru xpdf-3.02/debian/changelog xpdf-3.02/debian/changelog --- xpdf-3.02/debian/changelog 2010-12-19 23:48:17.000000000 +0000 +++ xpdf-3.02/debian/changelog 2011-08-28 22:52:02.000000000 +0000 @@ -1,3 +1,9 @@ +xpdf (3.02-12squeeze1) stable-proposed-updates; urgency=low + + * Fix cve-2011-2902: insecure tempfile usage in zxpdf. + + -- Michael Gilbert Sun, 28 Aug 2011 20:57:35 +0000 + xpdf (3.02-12) unstable; urgency=high * zxpdf: don't erase original pdf file during clean up (closes: #598945). diff -Nru xpdf-3.02/debian/zxpdf xpdf-3.02/debian/zxpdf --- xpdf-3.02/debian/zxpdf 2010-12-19 23:42:40.000000000 +0000 +++ xpdf-3.02/debian/zxpdf 2011-08-28 20:58:31.000000000 +0000 @@ -50,8 +50,7 @@ then tmp="$file" else - tmp=$(basename "$file") - tmp=$(tempfile -p "${tmp%.pdf*}" -s .pdf) + tmp=$(tempfile -s .pdf) $cat "$file" >"$tmp" fi