Patch from upstream, not yet available in latest stable release--
http://www.logilab.org/revision/210454
--to fix CVE-2014-1839.

diff -rupN logilab-common-0.58.2-orig/ChangeLog logilab-common-0.58.2/ChangeLog
--- logilab-common-0.58.2-orig/ChangeLog	2014-03-14 10:39:51.021176000 -0700
+++ logilab-common-0.58.2/ChangeLog	2014-03-14 10:43:43.925212000 -0700
@@ -4,6 +4,9 @@ ChangeLog for logilab.common
 2014-02-03
    * pdf_ext: removed, it had no known users (CVE-2014-1838)
 
+   * shellutils: fix tempfile issue in Execute, and deprecate it
+     (CVE-2014-1839)
+
 
 2012-07-30  --  0.58.2
     * modutils: fixes (closes #100757 and #100935)
diff -rupN logilab-common-0.58.2-orig/shellutils.py logilab-common-0.58.2/shellutils.py
--- logilab-common-0.58.2-orig/shellutils.py	2012-07-30 06:06:59.000000000 -0700
+++ logilab-common-0.58.2/shellutils.py	2014-03-14 10:46:41.707010000 -0700
@@ -31,11 +31,13 @@ import fnmatch
 import errno
 import string
 import random
+import subprocess
 from os.path import exists, isdir, islink, basename, join
 
 from logilab.common import STD_BLACKLIST, _handle_blacklist
 from logilab.common.compat import raw_input
 from logilab.common.compat import str_to_bytes
+from logilab.common.deprecation import deprecated
 
 try:
     from logilab.common.proc import ProcInfo, NoSuchProcess
@@ -224,20 +226,17 @@ def unzip(archive, destdir):
             outfile.write(zfobj.read(name))
             outfile.close()
 
+@deprecated('Use subprocess.Popen instead')
 class Execute:
     """This is a deadlock safe version of popen2 (no stdin), that returns
     an object with errorlevel, out and err.
     """
 
     def __init__(self, command):
-        outfile = tempfile.mktemp()
-        errfile = tempfile.mktemp()
-        self.status = os.system("( %s ) >%s 2>%s" %
-                                (command, outfile, errfile)) >> 8
-        self.out = open(outfile, "r").read()
-        self.err = open(errfile, "r").read()
-        os.remove(outfile)
-        os.remove(errfile)
+        cmd = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+        self.out, self.err = cmd.communicate()
+        self.status = os.WEXITSTATUS(cmd.returncode)
+
 
 def acquire_lock(lock_file, max_try=10, delay=10, max_delay=3600):
     """Acquire a lock represented by a file on the file system