Summary
It was discovered that click did not properly perform input sanitization
during click package installation. If a user were tricked into installing a
crafted click package, a remote attacker could exploit this to escalate
privileges by tricking click into installing lenient security policy for
the installed application.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | click | 0.4.21.1ubuntu0.2 |
Vulnerabilities 1
-
Unscored —
click/install.py in click does not require files in package filesystem tarballs to start with ./ (dot slash), which all…