[ubuntu/trusty-security] click 0.4.21.1ubuntu0.2 (Accepted)

[Jamie Strandboge]

click (0.4.21.1ubuntu0.2) trusty-security; urgency=medium

  * SECURITY UPDATE: fix privilege escalation via crafted data.tar.gz that
    can be used to install alternate security policy than what is defined
    - click/install.py: Forbid installing packages with data tarball members
      whose names do not start with "./". Based on patch from Colin Watson.
    - CVE-2015-XXXX
    - LP: #1506467

Date: 2015-10-15 15:23:24.256106+00:00
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Maintainer: Colin Watson <cjwatson at canonical.com>
https://launchpad.net/ubuntu/+source/click/0.4.21.1ubuntu0.2
-------------- next part --------------
Sorry, changesfile not available.