Fedora 20: 2015-5546 Critical arj Buffer Overflow & Traversal Fixes
fedora
April 13, 2015
- Added patch from Debian to avoid free on invalid pointer due to a buffer overflow (#1196751, #1207180) - Added patch from Debian for symlink directory traversal (#1178824) - Adde...
Summary
This package is an open source version of the arj archiver. It has
been created with the intent to preserve maximum compatibility and
retain the feature set of original ARJ archiver as provided by ARJ
Software, Inc.
Update Information:
- Added patch from Debian to avoid free on invalid pointer due to a buffer overflow (#1196751, #1207180) - Added patch from Debian for symlink directory traversal (#1178824) - Added patch from Debian to fix the directory traversal via //multiple/leading/slash (#1178824)
Topics Covered
Change Log
* Fri Apr 3 2015 Robert Scheck
References
[ 1 ] Bug #1178824 - CVE-2015-0556 CVE-2015-0557 arj: two directory traversal flaws
https://bugzilla.redhat.com/show_bug.cgi?id=1178824
[ 2 ] Bug #1207180 - CVE-2015-2782 arj: free on invalid pointer due to to buffer overflow
https://bugzilla.redhat.com/show_bug.cgi?id=1207180
[ 3 ] Bug #1196751 - arj: buffer overflow write access initiated by a size read from a crafted archive
https://bugzilla.redhat.com/show_bug.cgi?id=1196751
Update Instructions
This update can be installed with the "yum" update program. Use su -c 'yum update arj' at the command line. For more information, refer to "Managing Software with yum", available at .
PREVIOUS
NEXT
Severity
critical
Lowest
Low
Medium
High
Critical
Name: arj
Product: Fedora 20
Version: 3.10.22
Release: 22.fc20
URL:
Summary: Archiver for .arj files
Topics Covered
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!