-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Package : storebackup Version : 3.2.1-1+deb8u1 CVE ID : CVE-2020-7040 Debian Bug : 949393
storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. Local users can also create a plain file named /tmp/storeBackup.lock to block use of storeBackup until an admin manually deletes that file. For Debian 8 "Jessie", this problem has been fixed in version 3.2.1-1+deb8u1. We recommend that you upgrade your storebackup packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAl46mxUACgkQgj6WdgbD S5ZfDBAAqcrXQmC1ELUCdHSqEL+1TMnd/zbtYAT3+VmM3mWcwZlUus61e9EM78d+ hQoaG3Qnrm0uecnLz2uPfNMWw5AMp/bjsN9FnDgSexgO27v4czkr6yn/Imx4QsLi qaW4LEpiWFE5xg6jBA7Jf2bqKU/TkTlupNOUz5w2qyPfHUdIMTjGWSDU2iqfSNkf W3F0oTTQVtNJPYThwoCOo8MYtPkDfq2B8VZ6CbxNIBiXZHLyVXVVRdWSAoV64bK9 QceP3oAfJbL+YuUlW1Mil6v8jxHOVQ/TmC3jfbRP9TndzcrBWAVibMfWEuC24JQ3 tXsIPFCW0Egyb1UkT12xCmEfbfAEOl/se6ke0NacaqU+DaBGVCtE+ytDb7dXkdvm toemeohpOpA/qeUXe0uNKCSC2Qx20/YSWo/R5KcIz6Iz/ZtV3OoLo+i/w6wyG2F4 6JAzqEVeEd1dNVg3bztuKbOnRO8cxoClKMql28j6NLzuW9vhqL+oVukgIFiTd/h9 Wjs0mtNnPPvS3AC762YC6txW3q0PvOloOOgKPbeRtmyyMgcBWZxx1pFacCwHyuUJ 7cEWiE89cZKFTlUjsAk5JFUJGucmLNAVxFFcxGy3Q7PU0DgkkpX6BjRawic3YJv2 nFv1VAp7hoQn3qJ0Cb5ROD9BprjeTZvIHTyxERSQ6JHXYgjDMoQ= =BMrt -----END PGP SIGNATURE-----