Re: Request for CVE Identifier: bzexe insecure temporary file

[Ramon de C Valle <rcvalle () redhat com>]

> Have you checked if this also affects gzexe? It is pretty much the
> same
> as bzexe, just using gzip instead of bzip2. (afaik, no xzexe exists)
It seems this issue affects only executables compressed by bzexe. The self-uncompressing executable created by gzexe 
seems to make appropriate use of the /tmp directory uncompressing the executable file to a previously created 
subdirectory created with mkdir--all with appropriate permissions.


-- 
Ramon de C Valle / Red Hat Security Response Team