po4a: Insecure temporary file creation

po4a: Insecure temporary file creation A vulnerability has been discovered in po4a, allowing for a symlink attack. po4a September 13, 2007 September 13, 2007: 01 189440 local 0.32-r1 0.32-r1

po4a is a set of tools for helping with the translation of documentation.

The po4a development team reported a race condition in the gettextize() function when creating the file "/tmp/gettextization.failed.po".

A local attacker could perform a symlink attack, possibly overwriting files with the permissions of the user running po4a.

There is no known workaround at this time.

All po4a users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=app-text/po4a-0.32-r1"

CVE-2007-4462 jaervosz jaervosz p-y