Debian alert DLA-3026-1 (filezilla)

From:
             
 
Andreas Rönnquist <gusnan@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 3026-1] filezilla security update
Date:
             
 
Thu, 26 May 2022 14:58:52 +0200
Message-ID:
             
 
<628f798d.1c69fb81.5a3a7.0df6@mx.google.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3026-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                   Andreas Rönnquist
May 26, 2022                                  https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : filezilla
Version        : 3.24.0-1+deb9u1
CVE ID         : CVE-2019-5429
Debian Bug     : 

Untrusted search path in FileZilla before 3.41.0-rc1 allows an
attacker to gain privileges via a malicious 'fzsftp' binary in 
the user's home directory.

For Debian 9 stretch, this problem has been fixed in version
3.24.0-1+deb9u1.

We recommend that you upgrade your filezilla packages.

For the detailed security status of filezilla please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/filezilla

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE2zBuSxD/2Y7021XXGUtjGrLaKIgFAmKPeOgACgkQGUtjGrLa
KIiHgw/+Jj0n6g1No+dOwz5VlHt8E7aE1oCMU8tVHitLn4o75q5dWBPflJyvnfdx
dzWVCiz7hB3ehrN/0qjQH5J+k5SJ8OgZeXs8XqzfjJwg3IKAvvwhfh/K7cCP//fW
pae7NJB2ZfpDsw1+PKgTCdVKETEi0oRbd12kMnyqVa/PATloeZIJ8Ywxhm8bIShq
nuK7rmJEtAtysHvx8iIMASOxaITzbzv9RG8NmAaT+I4lIhvSvWZ/BPp38u2izN8Y
EavMuYud+D2uh4BYJtJOfrTcZ+pcID4p8Cs7jv562hmtcCJB+Af933nykeva6V7V
6LQZf96dsnTYbBV9DsCZ6DSTSXqST7ILLjQ5+tEaDx22cymIg2VHm1kbufTYGlAN
jLb72UD5mzsNT75SFZyhg3DpWEvvmMLstQUpgxKtP+ww7Onjdqz7cSs9mH/dsmdG
okSMqRW400OrYF0dgoWA4OJbiQ+KlL7KkRgHJzZxUmhyuK4ck6CbZDYby3/90khz
HvAWGJ+Y75UHYMIByEro6SRPQPkJkBU123htHs5gSCc4+YCwyOP3mV4avz5YqgbR
0/BY8z25SehvOfZ8dcaRVH5UMcUEIRfRK0TYnTQBrJqqeujwT9g5T//rYevCUQPt
MPqudb4YtpTy27C86wg28GL4S1Nhxu7aBDv7jUatQGl+PceFF/c=
=c4ai
-----END PGP SIGNATURE-----