Skip to content

Monolingual 2.0.4

Latest

Choose a tag to compare

@github-actions github-actions released this 02 Nov 05:49
· 4 commits to main since this release
d80d437

A security release.

  • Stripping debug information no longer follows a symbolic link. With "Strip debug info when
    removing architectures" enabled, the helper rewrote each executable by path, and /usr/bin/strip
    follows a link at the end of one. A link swapped in for a file after the helper had looked at it
    had its target rewritten as root, and the ownership the helper put back afterwards was applied to
    that target as well. The file is now opened without following, strip is given a copy in a
    private directory, and the result is written back through that descriptor.

The Trash path had the same kind of problem; 2.0.3 fixed it —
GHSA-9gmw-jhrw-g8wf.