GNU Automake 1.11.6 released (fixes a SECURITY VULNERABILITY!)

Article View: gnu.announce

Article #361

#361

From: Stefano Lattarini
Date: Mon, 09 Jul 2012 16:14

24 lines
3537 bytes

This message announces the Automake 1.11.6 bug-fixing release.

This release FIXES A SECURITY VULNERABILITY (CVE-2012-3386), so you are
strongly encouraged to upgrade your existing Automake installation ASAP.

With this release, the recipe of the 'distcheck' target no longer grants
temporary world-wide write permissions on the extracted distdir.  Even if
such rights were only granted for a vanishingly small time window, the
implied race condition proved to be enough to allow a local attacker to
run arbitrary code with the privileges of the user running "make distcheck".

The fix of this security vulnerability is the only change between the
earlier 1.11.5 release and the present 1.11.6 one.

Download the fixed release here:

  ftp://ftp.gnu.org/gnu/automake/automake-1.11.6.tar.gz
  ftp://ftp.gnu.org/gnu/automake/automake-1.11.6.tar.xz

Please report bugs and problems to <bug-automake@gnu.org>, and send
general comments and feedback to <automake@gnu.org>.

Thanks to everyone who has reported problems, contributed patches,
and helped testing Automake!

Technical Details

Message-ID: <mailman.4436.1341868611.855.info-gnu@gnu.org>

Path:

arc1-ca.pugleaf.net!l9ni11215pbj.0!nntp.google.com!news1.google.com!news2.google.com!news.glorb.com!usenet.stanford.edu!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Thread: fba7b,740c3a4193a3a46d,start
X-Google-NewGroupId: yes
X-Google-Attributes: gid4622fc145,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Received: by 10.68.219.170 with SMTP id pp10mr22479520pbc.1.1341868612332;
        Mon, 09 Jul 2012 14:16:52 -0700 (PDT)
Path: arc1-ca.pugleaf.net!l9ni11215pbj.0!nntp.google.com!news1.google.com!news2.google.com!news.glorb.com!usenet.stanford.edu!not-for-mail
From: Stefano Lattarini <stefano.lattarini@gmail.com>
Newsgroups: gnu.announce
Subject: GNU Automake 1.11.6 released (fixes a SECURITY VULNERABILITY!)
Date: Mon, 09 Jul 2012 18:14:03 +0200
Lines: 26
Approved: info-gnu@gnu.org
Message-ID: <mailman.4436.1341868611.855.info-gnu@gnu.org>
NNTP-Posting-Host: lists.gnu.org
Mime-Version: 1.0
X-Trace: usenet.stanford.edu 1341868611 4091 208.118.235.17 (9 Jul 2012 21:16:51 GMT)
X-Complaints-To: action@cs.stanford.edu
Cc: info-gnu@gnu.org, autotools-announce@gnu.org
To: Automake List <automake@gnu.org>
Envelope-to: info-gnu@gnu.org
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=message-id:date:from:mime-version:to:cc:subject:content-type
 :content-transfer-encoding;
 bh=qu9YIj1+7XpgbHW+OTn0vSWF6sv9LauWeU5nu+nPECk=;
 b=h+3BWx8cKWBCIvgI+FsYKYah4OX5WU1dGSdUeVV3ESeemPRdS+wa1ZI8yNd4VZr2WS
 jpMKR9nGMvZ48Rsmvo4n5ml5k6ZjnY9+/Xl0g4TpaPUTtLksnIp8DvilAWfLxpra8Avh
 zMXiiXceXQ86j8HJGthZx5SQKhGBVmKzLFG6doov1yTgg7BrkyaeoJ6MM6MFWdoObAQF
 VG6gUt0/x9TMPCB8CmHoaIgHF+Da9eKf0cEObApCvP4cyAP56h5DW09bl9b/D6UUhwq3
 HB89mrLrVPCZMFZSizSK7uqcg6rGvfrpShbNs+oyPA/F7/dQvyiKwu0+NnjK8Z0fgfJa
 Mk8A==
X-detected-operating-system: by eggs.gnu.org: Genre and OS details not
 recognized.
X-Received-From: 209.85.214.41
X-Mailman-Approved-At: Mon, 09 Jul 2012 17:16:49 -0400
X-BeenThere: info-gnu@gnu.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Announcements and Requests for Help from the GNU project and the Free
 Software Foundation <info-gnu.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/info-gnu>,
 <mailto:info-gnu-request@gnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/archive/html/info-gnu>
List-Post: <mailto:info-gnu@gnu.org>
List-Help: <mailto:info-gnu-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/info-gnu>,
 <mailto:info-gnu-request@gnu.org?subject=subscribe>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit