{"id":"DSA-279","summary":"metrics - insecure temporary file creation","details":"\nPaul Szabo and Matt Zimmerman discovered two similar problems in\nmetrics, a tools for software metrics. Two scripts in this package,\n\"halstead\" and \"gather\\_stats\", open temporary files without taking\nappropriate security precautions. \"halstead\" is installed as a user\nprogram, while \"gather\\_stats\" is only used in an auxiliary script\nincluded in the source code. These vulnerabilities could allow a\nlocal attacker to overwrite files owned by the user running the\nscripts, including root.\n\n\nThe stable distribution (woody) is not affected since it doesn't\ncontain a metrics package anymore.\n\n\nFor the old stable distribution (potato) this problem has been fixed\nin version 1.0-1.1.\n\n\nThe unstable distribution (sid) is not affected since it doesn't\ncontain a metrics package anymore.\n\n\nWe recommend that you upgrade your metrics package.\n\n\n","modified":"2022-07-04T02:00:57.189789Z","published":"2003-04-07T00:00:00Z","withdrawn":"2024-05-15T05:36:14.112431Z","schema_version":"1.7.3"}