Home > Security > Advisories


Mandriva Advisories

Package name joe
Date March 6th, 2001
Advisory ID MDKSA-2001:026
Affected versions 6.0, 6.1, 7.0, 7.1, 7.2, CS1.0
Synopsis Updated joe packages fix vulnerability with .joerc files in CWD

Problem Description

The joe text editor looks for configuration files in the current
working directory, the user's home directory, and finally in /etc/joe.
A malicious user could create their own .joerc configuration file and
attempt to get other users to use it. If this were to happen, the user
could potentially execute malicious commands with their own user ID and
privileges. This update removes joe's ability to use a .joerc
configuration file in the current working directory.

Updated Packages

Mandrakelinux 6.0

 56d2f6a0631af8bd0e1277ff9ac61c79  6.0/RPMS/joe-2.8-21.6mdk.i586.rpm
43b6715da08c931174df9bdca65c5bd2  6.0/SRPMS/joe-2.8-21.6mdk.src.rpm

Mandrakelinux 6.1

 8d580b730449cd83cd3140ed5e85b711  6.1/RPMS/joe-2.8-21.6mdk.i586.rpm
43b6715da08c931174df9bdca65c5bd2  6.1/SRPMS/joe-2.8-21.6mdk.src.rpm

Mandrakelinux 7.0

 96713b9dbd1d08045de30a5d3325e0e1  7.0/RPMS/joe-2.8-21.6mdk.i586.rpm
43b6715da08c931174df9bdca65c5bd2  7.0/SRPMS/joe-2.8-21.6mdk.src.rpm

Mandrakelinux 7.1

 633c0600124591eb3a0d9f1299709b18  7.1/RPMS/joe-2.8-21.5mdk.i586.rpm
10fa82ea14185c6df59c2eb282b628ff  7.1/SRPMS/joe-2.8-21.5mdk.src.rpm

Mandrakelinux 7.2

 35c4075c50bf84dde42573f20f549772  7.2/RPMS/joe-2.8-21.4mdk.i586.rpm
c6ff0ce8ad7365cfd2795c178b5e5f01  7.2/SRPMS/joe-2.8-21.4mdk.src.rpm

Corporate Server 1.0.1

 633c0600124591eb3a0d9f1299709b18  1.0.1/RPMS/joe-2.8-21.5mdk.i586.rpm
10fa82ea14185c6df59c2eb282b628ff  1.0.1/SRPMS/joe-2.8-21.5mdk.src.rpm


To upgrade automatically, use MandrivaUpdate.


Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :

                rpm --checksig package.rpm

You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.

If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.