| Subject: | Insecure /tmp file handing |
The dave client uses predictable filenames in a world writable directory
in command_edit(). This should be fairly simple to exploit with a symlink.
Additionally, the default umask is used which will make the file world
readable while it resides on the local system.