El 22/12/14 a las 17:29, Salvatore Bonaccorso escribió:
Source: unzip
Version: 6.0-4
Severity: grave
Tags: security upstream
Hi,
the following vulnerabilities were published for unzip.
(disclaimer I was not yet able to verify any of those, but oCert
advisory claims to affect all unzip <= 6.0).
CVE-2014-8139[0]:
CRC32 heap overflow
CVE-2014-8140[1]:
heap overflow in test_compr_eb
CVE-2014-8141[2]:
heap overflow in getZip64Data
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
More information are found in the corresponding Red Hat bugzilla
entries.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2014-8139
[1] https://security-tracker.debian.org/tracker/CVE-2014-8140
[2] https://security-tracker.debian.org/tracker/CVE-2014-8141
[3] http://www.ocert.org/advisories/ocert-2014-011.html
Ok, there are patches available in all cases.
Working on it.
--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
