Re: Security fixes in m4-1.4.11

[Josh Bressers <bressers () redhat com>]

> On Sun, 6 Apr 2008, Patrick J. Volkerding wrote:
>
> > Minor security fix: Quote output of mkstemp.
>
> Use CVE-2008-1687
>
> > Security fix: avoid arbitrary code execution with 'm4 -F'.
>
> Use CVE-2008-1688
>
> Note - these CVE's will not be live until Monday.

So I took a look at these today, I don't think either is really a security
issue.

Both issues are certainly bugs, but given each situation, it would be just
as easy to get a victim to run something blatantly malicious that doesn't
need to leverage obscure flaws in the language.

Has anyone else had a look?

Thanks.

-- 
    JB