Updated SANE and XSane packages fix temporary file handling vulnerabilities

Updated SANE and XSane packages are available, which fix insecure handling
of temporary files.

XSane is an X-based interface providing access to scanners, digital
cameras, and other capture devices. When XSane creates temporary files, it
does so with predictable filenames in a manner that would follow symbolic
links. This could allow a local user to overwrite files
written by the user running XSane.

Additionally, the SANE library that XSane uses also has some similar
problems. When some SANE backend drivers created temporary files they
did so in a manner that would follow symbolic links. These packages
prevent that kind of attack. The default configuration had one of these
backends enabled. These packages update XSane to version 0.82 and turn off
the vulnerable backend in the default configuration.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CAN-2001-0887 and CAN-2001-0890 to these issues.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0887
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0890
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0887
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0890
http://www.securityfocus.com/bid/3700

files, sane, temporary, xsane