Debian alert DLA-1564-1 (mono)

From:
             
 
Markus Koschany <apo@debian.org> 
To:
             
 
debian-lts-announce@lists.debian.org 
Subject:
             
 
[SECURITY] [DLA 1564-1] mono security update 
Date:
             
 
Thu, 1 Nov 2018 20:42:40 +0100
Message-ID:
             
 
<e2c1f65a-a158-932e-9724-ae8b8ecf91e6@debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Package        : mono
Version        : 3.2.8+dfsg-10+deb8u1
CVE ID         : CVE-2009-0689

It was found that Mono’s string-to-double parser may crash, on
specially crafted input. This could lead to arbitrary code execution.

CVE-2018-1002208: Mono embeds the sharplibzip library which is
vulnerable to directory traversal, allowing attackers to write to
arbitrary files via a ../ (dot dot slash) in a Zip archive entry that
is mishandled during extraction. This vulnerability is also known as
'Zip-Slip'.

The Mono developers intend to entirely remove sharplibzip from the
sources and do not plan to fix this issue. It is therefore recommended
to fetch the latest sharplibzip version by using the nuget package
manager instead. The embedded version should not be used with
untrusted zip files.

For Debian 8 "Jessie", this problem has been fixed in version
3.2.8+dfsg-10+deb8u1.

We recommend that you upgrade your mono packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAlvbVzBfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7
UeT0gA/9G71ZJ7mpY6YuLNKhpaASL1x+5Tpt/W1rGvHUjR9z0yrlimW1W2dHjabi
ranLcvor8mn20/j0/odCQjQClPOsg08+u6Ncpg4UDFjGkgISpvriXayhfPgAJ0Ba
65Nuaajl1tc3RMXVi2ipYgf41D6yd4iIvvQaFYzWzDO5da9qToBF+Fe35xNx0Wfi
CGLOTTwPdQ4uiSntMR+o504URDueWbOveGtM4cGHGUEzSnowjzo8pNvvAtK+tMG+
AF302LC2NoX1hB/XbevuENG8SLk3skLS+zCNPA9+70KIc5Ls1CmqwGRZFB1rzzR7
UAv+f9uMItMSNV2c0Q8uUR2/hvv2rloHKyXj0g97rm18vrfp9iUlb/b+JPAMUZtS
46sZ6lyTaooM40Pd30BQ7iWa54RchHfBr6NaDXp37/5MNGc6P/kTB4PRwwrKXITN
+//mMvFwnlotfvSxBjfKuO7F5DGjh6xnPLEEuhSxD4P6rrAipoSJF9S75p7bDUev
54mQ5PKVahmf+hF79Vn4E02w+LAx8x9o52LYVUpwPpUWUYXy3Rq9d1yiXa1aKW5O
iITyZT+nIXOtVdvhog3yYfRWLtxsB8d5bWOevUdfqJSToQgTdBGVHjntnY73/sW3
rBYTGQrSD/n3jSxai/ruDcpsSlfC8hTUHUg8XNSZ+Pm/Jno+54s=
=7Lfo
-----END PGP SIGNATURE-----