Paketname
libtar
Datum
2014-02-20
Advisory ID
MDVSA-2014:045
Betroffene Versionen
MES5 i586 , MBS1 x86_64 , MES5 x86_64

Problembeschreibung

A directory traversal attack was reported against libtar, a C library
for manipulating tar archives. The application does not validate
the filenames inside the tar archive, allowing to extract files in
arbitrary path. An attacker can craft a tar file to override files
beyond the tar_extract_glob and tar_extract_all prefix parameter
(CVE-2013-4420).

The updated packages have been patched to correct this issue.

Aktualisierte Pakete

MES5 i586

 9c41216c3e2a51a66b92fac79f24145e  mes5/i586/libtar-1.2.11-8.2mdvmes5.2.i586.rpm
 b3c2c7a0f5b6485cef4cea7b3a1260eb  mes5/i586/libtar-devel-1.2.11-8.2mdvmes5.2.i586.rpm 
 394c02d53c5ed8aee4ba0120c8c323f4  mes5/SRPMS/libtar-1.2.11-8.2mdvmes5.2.src.rpm

MBS1 x86_64

 f61a5b919d27fba85205633da3703b17  mbs1/x86_64/libtar-1.2.11-11.2.mbs1.x86_64.rpm
 3e6b2e5a5567eb957c7046314788078e  mbs1/x86_64/libtar-devel-1.2.11-11.2.mbs1.x86_64.rpm 
 707c993007a990897d2d85c8a6bdbfd0  mbs1/SRPMS/libtar-1.2.11-11.2.mbs1.src.rpm

MES5 x86_64

 789f1f0d19a70b6270524ae75f82605b  mes5/x86_64/libtar-1.2.11-8.2mdvmes5.2.x86_64.rpm
 5c599c305977157852f7671e41705f46  mes5/x86_64/libtar-devel-1.2.11-8.2mdvmes5.2.x86_64.rpm 
 394c02d53c5ed8aee4ba0120c8c323f4  mes5/SRPMS/libtar-1.2.11-8.2mdvmes5.2.src.rpm

Referenzen