From 5243fda46ffffef0762098ce1aa2039db43ce479 Mon Sep 17 00:00:00 2001 From: Stefano Lattarini Date: Mon, 9 Jul 2012 18:20:33 +0200 Subject: [PATCH] news: improve wording in entry about CVE-2012-3386 Signed-off-by: Stefano Lattarini --- NEWS | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/NEWS b/NEWS index 800c7ebdd..8475ac25e 100644 --- a/NEWS +++ b/NEWS @@ -99,12 +99,12 @@ Bugs fixed in 1.12.2: * SECURITY VULNERABILITIES! - - The recipe of the 'distcheck' no longer grants anymore temporary - world-wide write permissions on the extracted distdir. Even if such - rights were only granted for a vanishingly small time window, the - implied race condition proved to be enough to allow a local attacker - to run arbitrary code with the privileges of the user running "make - distcheck". This is CVE-2012-3386. + - The 'distcheck' recipe no longer grants temporary world-write + permissions on the extracted distdir. Even if such rights were + only granted for a vanishingly small time window, the implied + race condition proved to be enough to allow a local attacker + to run arbitrary code with the privileges of the user running + "make distcheck". This is CVE-2012-3386. * Long-standing bugs: -- 2.47.2