Version1.6-1 of "cabextract" has been uploaded.
cabextract is a utility for extracting Microsoft Cabinet (.CAB) files
This update fixes a number of security bugs:
* CVE-2014-9556: A CAB file with invalid file offset or length (where
offset + length == 2^32) causes an infinite loop in the Quantum
decoder on 32-bit architectures. [Debian bugs #772891, #773041]
* CVE-2015-2060: A CAB file with overlong UTF-8 encodings for "/" can
get its files extracted to an absolute path instead of the current
directory. [Debian bug #778753]
* On Cygwin, a CAB file using both "/" and "\" can evade checks for
absolute files and "../" directory traversals and can get its files
extracted to any path.
* A CAB file with two folders, the second folder invalid, and a file
decompression order of folder 1, 2, 1, causes execution to jump to
NULL. [Debian bugs #773659, #774665]
* A CAB file with MSZIP-compressed data and a distance code of 30
causes a 1 byte over-read [Debian bug #775498]
* A CAB file with zero-length filenames causes a 1 byte over-read.
* A CAB file with invalid UTF-8 encoded filenames causes over-read of
up to 5 bytes.
* A CAB file with LZX-compressed data ending early during an odd-sized
uncompressed block can cause a 1-byte under-read. [Debian bug #775499]
*** CYGWIN-ANNOUNCE UNSUBSCRIBE INFO ***
If you want to unsubscribe from the cygwin-announce mailing list, look
at the "List-Unsubscribe: " tag in the email header of this message.
Send email to the address specified there. It will be in the format:
cygwin-announce-unsubscribe-you=yourdomain.com <at> cygwin.com
If you need more information on unsubscribing, start reading here:
http://sourceware.org/lists.html#unsubscribe-simple
Please read *all* of the information on unsubscribing that is
available starting at this URL.
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
