Stay Secure with the Latest Linux Advisories

security advisorybuffer overflowFedora

Fedora 22: Security Advisory for ARJ Critical Buffer Overflow Fix

- Added patch from Debian to avoid free on invalid pointer due to a buffer overflow (#1196751, #1207180) - Added patch from Debian for symlink directory traversal (#1178824) - Added patch from Debian to fix the directory traversal via //multiple/leading/slash (#1178824). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-5524 2015-04-04 15:18:26 -------------------------------------------------------------------------------- Name : arj Product : Fedora 22 Version : 3.10.22 Release : 22.fc22 URL : https://arj.sourceforge.net/ Summary : Archiver for .arj files Description : This package is an open source version of the arj archiver. It has been created with the intent to preserve maximum compatibility and retain the feature set of original ARJ archiver as provided by ARJ Software, Inc. -------------------------------------------------------------------------------- Update Information: - Added patch from Debian to avoid free on invalid pointer due to a buffer overflow (#1196751, #1207180) - Added patch from Debian for symlink directory traversal (#1178824) - Added patch from Debian to fix the directory traversal via //multiple/leading/slash (#1178824) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1178824 - CVE-2015-0556 CVE-2015-0557 arj: two directory traversal flaws https://bugzilla.redhat.com/show_bug.cgi?id=1178824 [ 2 ] Bug #1196751 - arj: buffer overflow write access initiated by a size read from a crafted archive https://bugzilla.redhat.com/show_bug.cgi?id=1196751 [ 3 ] Bug #1207180 - CVE-2015-2782 arj: free on invalid pointer due to to buffer overflow https://bugzilla.redhat.com/show_bug.cgi?id=1207180 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update arj' at the command line. For more information,refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. https://lists.fedoraproject.org/admin/lists/package-announce.lists.fedoraproject.org/ . The latest Fedora update alert for arj addresses critical vulnerabilities related to buffer overflow and directory traversal, implementing improved security measures.. arj Security Update,Fedora Updates,Buffer Overflow Fix. . Severity: Critical. LinuxSecurity.com Team

Apr 21, 2015 •Critical Fedora