Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

Fedora 22: Security Advisory for ARJ Critical Buffer Overflow Fix

fedora
Calendar Grey April 21, 2015
Scroller Fedora
The latest Fedora update alert for arj addresses critical vulnerabilities related to buffer overflow and directory traversal, implementing improved security measures.
- Added patch from Debian to avoid free on invalid pointer due to a buffer overflow (#1196751, #1207180) - Added patch from Debian for symlink directory traversal (#1178824) - Adde...

Summary

This package is an open source version of the arj archiver. It has

been created with the intent to preserve maximum compatibility and

retain the feature set of original ARJ archiver as provided by ARJ

Software, Inc.

Update Information:

- Added patch from Debian to avoid free on invalid pointer due to a buffer overflow (#1196751, #1207180) - Added patch from Debian for symlink directory traversal (#1178824) - Added patch from Debian to fix the directory traversal via //multiple/leading/slash (#1178824)

Topics%20covered

Topics Covered

security advisory buffer overflow Fedora directory traversal archiver

Change Log

References


[ 1 ] Bug #1178824 - CVE-2015-0556 CVE-2015-0557 arj: two directory traversal flaws https://bugzilla.redhat.com/show_bug.cgi?id=1178824 [ 2 ] Bug #1196751 - arj: buffer overflow write access initiated by a size read from a crafted archive https://bugzilla.redhat.com/show_bug.cgi?id=1196751 [ 3 ] Bug #1207180 - CVE-2015-2782 arj: free on invalid pointer due to to buffer overflow https://bugzilla.redhat.com/show_bug.cgi?id=1207180

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update arj' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
critical
Lowest
Low
Medium
High
Critical

Name: arj
Product: Fedora 22
Version: 3.10.22
Release: 22.fc22
URL: https://arj.sourceforge.net/
Summary: Archiver for .arj files

Topics%20covered

Topics Covered

security advisory buffer overflow Fedora directory traversal archiver

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.