www-plugins/gnash/files/gnash-0.8.9-cve-2011-4328.patch


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

From fa481c116e65ccf9137c7ddc8abc3cf05dc12f55 Mon Sep 17 00:00:00 2001
From: Gabriele Giacone <1o5g4r8o@gmail.com>
Date: Sun, 20 Nov 2011 17:27:42 +0100
Subject: [PATCH] Make cookie file not world-readable. Fixes http://bugs.debian.org/649384

---
 plugin/npapi/plugin.cpp |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/plugin/npapi/plugin.cpp b/plugin/npapi/plugin.cpp
index e161a1d..04950e6 100644
--- a/plugin/npapi/plugin.cpp
+++ b/plugin/npapi/plugin.cpp
@@ -1108,6 +1108,7 @@ nsPluginInstance::setupCookies(const std::string& pageurl)
     ss << "/tmp/gnash-cookies." << getpid();
 
     cookiefile.open(ss.str().c_str(), std::ios::out | std::ios::trunc);
+    chmod (ss.str().c_str(), 0600);
 
     // Firefox provides cookies in the following format:
     //
-- 
1.7.2.5