User: Password:
|
|
Subscribe / Log in / New account

Mageia alert MGASA-2014-0289 (dpkg)

From:  Mageia Updates <buildsystem-daemon@mageia.org>
To:  updates-announce@ml.mageia.org
Subject:  [updates-announce] MGASA-2014-0289: Updated dpkg packages fixes security vulnerabilities
Date:  Wed, 9 Jul 2014 00:48:10 +0200
Message-ID:  <20140708224810.959625AFD3@valstar.mageia.org>

MGASA-2014-0289 - Updated dpkg packages fixes security vulnerabilities Publication date: 08 Jul 2014 URL: http://advisories.mageia.org/MGASA-2014-0289.html Type: security Affected Mageia releases: 3, 4 CVE: CVE-2014-0471, CVE-2014-3864, CVE-2014-3865 Description: Jakub Wilk discovered that dpkg did not correctly parse C-style filename quoting, allowing for paths to be traversed when unpacking a source package, leading to the creation of files outside the directory of the source being unpacked (CVE-2014-0471). Multiple vulnerabilities were discovered in dpkg that allow file modification through path traversal when unpacking source packages with especially-crafted patch files (CVE-2014-3864, CVE-2014-3865). References: - https://bugs.mageia.org/show_bug.cgi?id=13279 - https://www.debian.org/security/2014/dsa-2915 - https://www.debian.org/security/2014/dsa-2953 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0471 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3864 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3865 SRPMS: - 4/core/dpkg-1.17.10-1.1.mga4 - 3/core/dpkg-1.16.15-1.1.mga3


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds