992N/A--- automake-1.11.2/NEWS.orig 2012-07-10 05:55:08.774803866 -0700
992N/A+++ automake-1.11.2/NEWS 2012-07-10 05:55:40.618794747 -0700
992N/A@@ -90,6 +90,15 @@
992N/A - The AM_COND_IF macro also works if the shell expression for the
992N/A conditional is no longer valid for the condition.
992N/A
992N/A+* SECURITY VULNERABILITIES!
992N/A+
992N/A+ - The recipe of the 'distcheck' no longer grants anymore temporary
992N/A+ world-wide write permissions on the extracted distdir. Even if such
992N/A+ rights were only granted for a vanishingly small time window, the
992N/A+ implied race condition proved to be enough to allow a local attacker
992N/A+ to run arbitrary code with the privileges of the user running "make
992N/A+ distcheck". This is CVE-2012-3386.
992N/A+
992N/A * Long-standing bugs:
992N/A
992N/A - The order of Yacc and Lex flags is fixed to be consistent with other
992N/A--- automake-1.11.2/lib/am/distdir.am.orig 2012-07-10 05:57:02.481964158 -0700
992N/A+++ automake-1.11.2/lib/am/distdir.am 2012-07-10 05:57:54.509361759 -0700
992N/A@@ -441,7 +441,7 @@
992N/A ## Make the new source tree read-only. Distributions ought to work in
992N/A ## this case. However, make the top-level directory writable so we
992N/A ## can make our new subdirs.
992N/A- chmod -R a-w $(distdir); chmod a+w $(distdir)
992N/A+ chmod -R a-w $(distdir); chmod u+w $(distdir)
992N/A mkdir $(distdir)/_build
992N/A mkdir $(distdir)/_inst
992N/A ## Undo the write access.