Mageia alert MGASA-2016-0142 (lha)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2016-0142: Updated lha packages fix CVE-2016-1925 
Date:
    	     
 
Thu, 21 Apr 2016 16:52:53 +0200
Message-ID:
    	     
 
<20160421145253.75CB49F642@duvel.mageia.org>
MGASA-2016-0142 - Updated lha packages fix CVE-2016-1925

Publication date: 21 Apr 2016
URL: http://advisories.mageia.org/MGASA-2016-0142.html

Type: security
Affected Mageia releases: 5
CVE: CVE-2016-1925

Description:
Updated lha package fixes security vulnerability:

The lha command is vulnerable to a buffer overflow while processing level 0
and level 1 headers while extracting an archive (CVE-2016-1925).

References:
- https://bugs.mageia.org/show_bug.cgi?id=17535

- http://openwall.com/lists/oss-security/2016/01/18/8

- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1925


SRPMS:
- 5/core/lha-1.14i-20160202.1.mga5