SciLinux: CVE-2007-4829 Moderate: Perl-Archive-Tar Security Fix

Date: Fri, 2 Jul 2010 14:35:18 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: Security ERRATA Moderate: perl-Archive-Tar on SL4.x,
 SL5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

Synopsis:	Moderate: perl-Archive-Tar security update
Issue date:	2010-07-01
CVE Names:	CVE-2007-4829

Multiple directory traversal flaws were discovered in the Archive::Tar
module. A specially-crafted tar file could cause a Perl script, using
the Archive::Tar module to extract the archive, to overwrite an
arbitrary file writable by the user running the script. (CVE-2007-4829)

This package upgrades the Archive::Tar module to version 1.39_01.

All applications using the Archive::Tar module must be restarted for
this update to take effect.

Note: SL 40-45 needed perl-IO-Zlib

SL 4.x

 SRPMS:
perl-Archive-Tar-1.39.1-1.el4_8.1.src.rpm
 i386:
perl-Archive-Tar-1.39.1-1.el4_8.1.noarch.rpm
perl-IO-Zlib-1.04-4.2.el4.noarch.rpm
 x86_64:
perl-Archive-Tar-1.39.1-1.el4_8.1.noarch.rpm
perl-IO-Zlib-1.04-4.2.el4.noarch.rpm

SL 5.x

 SRPMS:
perl-Archive-Tar-1.39.1-1.el5_5.1.src.rpm
 i386:
perl-Archive-Tar-1.39.1-1.el5_5.1.noarch.rpm
 x86_64:
perl-Archive-Tar-1.39.1-1.el5_5.1.noarch.rpm

-Connie Sieh
-Troy Dawson