[Pkg-phototools-devel] Bug#754899: rawstudio: Insecure use of temporary file.

[Steve Kemp]

Package: rawstudio
Version: 2.0-1.1
Severity: important

Dear Maintainer,

The function "rs_filter_graph" located in file ./librawstudio/rs-filter.c contains the following code:

        g_string_append_printf(str, "}\n");
        g_file_set_contents("/tmp/rs-filter-graph", str->str, str->len, NULL);

        ignore = system("dot -Tpng >/tmp/rs-filter-graph.png </tmp/rs-filter-graph");
        ignore = system("gnome-open /tmp/rs-filter-graph.png");

This code makes insecure use of two temporary files:

	/tmp/rs-filter-graph.png
        /tmp/rs-filter-graph

This allows the truncation of arbitrary files which are owned by the user running
rawstudio - for example:

	ln -s ~/.important /tmp/rs-filter-graph
	ln -s /etc/shadow /tmp/rs-filter-graph.png

This function should be updated to use a secure temporary file.

Steve
--
https://dns-api.com/




-- System Information:
Debian Release: 7.6
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.14-0.bpo.1-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF8, LC_CTYPE=en_US.UTF8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF8)
Shell: /bin/sh linked to /bin/dash