Repository navigation
A security release.
- Stripping debug information no longer follows a symbolic link. With "Strip debug info when
removing architectures" enabled, the helper rewrote each executable by path, and/usr/bin/strip
follows a link at the end of one. A link swapped in for a file after the helper had looked at it
had its target rewritten as root, and the ownership the helper put back afterwards was applied to
that target as well. The file is now opened without following,stripis given a copy in a
private directory, and the result is written back through that descriptor.
The Trash path had the same kind of problem; 2.0.3 fixed it —
GHSA-9gmw-jhrw-g8wf.