[Full-disclosure] [USN-104-1] unshar vulnerability

[Florian Weimer]

* Martin Pitt:

> Joey Hess discovered that "unshar" created temporary files in an
> insecure manner. This could allow a symbolic link attack to create or
> overwrite arbitrary files with the privileges of the user invoking the
> program.

Keep in mind that by design, unshar just pipes its input file to
/bin/sh.  Technically, the temporary file issue discovered by Joey is
still a vulnerability (as the attack vector is different), but it's
very desirable to phase out any remaining use of unshar (and shell
archives in general).