[Secure-testing-team] Bug#705690: libuser: CVE-2012-5630 CVE-2012-5644

[Salvatore Bonaccorso]

Package: libuser
Severity: important
Tags: security

Hi,

the following vulnerabilities were published for libuser.

CVE-2012-5630[0]:
TOCTOU race conditions by copying and removing directory trees

CVE-2012-5644[1]:
(Complete) Information disclosure when moving user's home directory

The patch however looks unfortunately quite substantial, see [2], so
might be better to update for unstable directly to the new upstream
version. 

Ghe, are you still interested/maintaining the package? I wonder
because there was no upload since 2008 apart NMUs.

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] http://security-tracker.debian.org/tracker/CVE-2012-5630
[1] http://security-tracker.debian.org/tracker/CVE-2012-5644
[2] https://bugzilla.redhat.com/show_bug.cgi?id=885724#c7

Regards,
Salvatore