[Secure-testing-team] Bug#577057: CVE-2010-0826: allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module.

[Giuseppe Iuculano]

Package: libnss-db
Severity: important
Tags: security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for libnss-db.

CVE-2010-0826[0]:
| The Free Software Foundation (FSF) Berkeley DB NSS module (aka
| libnss-db) 2.2.3pre1 reads the DB_CONFIG file in the current working
| directory, which allows local users to obtain sensitive information
| via a symlink attack involving a setgid or setuid application that
| uses this module.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0826
    http://security-tracker.debian.org/tracker/CVE-2010-0826


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAku+8rIACgkQNxpp46476arazQCdEeT99R+RjheufWMZGPStt86t
5swAniH/EMnFLJN+XkF0irBdpVBtiyEo
=smYk
-----END PGP SIGNATURE-----