Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 5 articles for you...
87
security advisorybuffer overflowcode executionDebian: DSA-4167-1 Critical: Sharutils Buffer Overflow Security Advisory
A buffer-overflow vulnerability was discovered in Sharutils, a set of utilities handle Shell Archives. An attacker with control on the input of the unshar command, could crash the application or execute arbitrary code in the its context. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-4167-1
Apr 05, 2018
•Critical
Debian
172
security advisorycriticalcode executionUbuntu 17.10 USN-3605-1 Critical: Sharutils Code Execution Risk
Sharutils could be made to execute arbitrary code if it opened a specially crafted file.. =========================================================================Ubuntu Security Notice USN-3605-1 March 22, 2018 sharutils vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 17.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Sharutils could be made to execute arbitrary code if it opened a specially crafted file. Software Description: - sharutils: shar, unshar, uuencode, uudecode Details: It was discovered that Sharutils incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 17.10: sharutils 1:4.15.2-2ubuntu0.1 Ubuntu 16.04 LTS: sharutils 1:4.15.2-1ubuntu0.1 Ubuntu 14.04 LTS: sharutils 1:4.14-1ubuntu1.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3605-1 CVE-2018-1000097 Package Information: https://launchpad.net/ubuntu/+source/sharutils/1:4.15.2-2ubuntu0.1 https://launchpad.net/ubuntu/+source/sharutils/1:4.15.2-1ubuntu0.1 https://launchpad.net/ubuntu/+source/sharutils/1:4.14-1ubuntu1.1 . A critical flaw in Sharutils enables the possibility of arbitrary code execution via malicious files in Ubuntu distributions. Immediate updates are recommended.. Sharutils, Code Execution, Ubuntu Security, Arbitrary Code. . Severity: Critical. LinuxSecurity.com Team
Mar 22, 2018
•Critical
Ubuntu
89
security advisorysecurity updateFedoraFedora 27: 2018-03-06 Severe Heap Overflow In Sharutils Unshar
This release fixes a heap buffer overflow when processing a shar archive by unshar tool if the arhive contains overlong lines.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-8f4b3fa844 2018-03-06 17:17:51.856083 --------------------------------------------------------------------------------Name : sharutils Product : Fedora 27 Version : 4.15.2 Release : 8.fc27 URL : http://www.gnu.org/software/sharutils/ Summary : The GNU shar utilities for packaging and unpackaging shell archives Description : The sharutils package contains the GNU shar utilities, a set of tools for encoding and decoding packages of files (in binary or text format) in a special plain text format called shell archives (shar). This format can be sent through e-mail (which can be problematic for regular binary files). The shar utility supports a wide range of capabilities (compressing, uuencoding, splitting long files for multi-part mailings, providing check-sums), which make it very flexible at creating shar files. After the files have been sent, the unshar tool scans mail messages looking for shar files. Unshar automatically strips off mail headers and introductory text and then unpacks the shar files. --------------------------------------------------------------------------------Update Information: This release fixes a heap buffer overflow when processing a shar archive by unshar tool if the arhive contains overlong lines. --------------------------------------------------------------------------------References: [ 1 ] Bug #1548018 - sharutils: heap-buffer-overflow in find_archive in unshar.c https://bugzilla.redhat.com/show_bug.cgi?id=1548018 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade sharutils' at the command line. For more information, refer to the dnf documentationavailable at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Mar 06, 2018
•Critical
Fedora
89
security advisoryFedoracritical updateFedora 27: 2018-8f4b3fa844 Critical: Sharutils Heap Overflow
This release fixes a heap buffer overflow when processing a shar archive by unshar tool if the arhive contains overlong lines.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-8f4b3fa844 2018-03-06 17:17:51.856083 --------------------------------------------------------------------------------Name : sharutils Product : Fedora 27 Version : 4.15.2 Release : 8.fc27 URL : http://www.gnu.org/software/sharutils/ Summary : The GNU shar utilities for packaging and unpackaging shell archives Description : The sharutils package contains the GNU shar utilities, a set of tools for encoding and decoding packages of files (in binary or text format) in a special plain text format called shell archives (shar). This format can be sent through e-mail (which can be problematic for regular binary files). The shar utility supports a wide range of capabilities (compressing, uuencoding, splitting long files for multi-part mailings, providing check-sums), which make it very flexible at creating shar files. After the files have been sent, the unshar tool scans mail messages looking for shar files. Unshar automatically strips off mail headers and introductory text and then unpacks the shar files. --------------------------------------------------------------------------------Update Information: This release fixes a heap buffer overflow when processing a shar archive by unshar tool if the arhive contains overlong lines. --------------------------------------------------------------------------------References: [ 1 ] Bug #1548018 - sharutils: heap-buffer-overflow in find_archive in unshar.c https://bugzilla.redhat.com/show_bug.cgi?id=1548018 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade sharutils' at the command line. For more information, refer to the dnf documentationavailable at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Mar 06, 2018
•Critical
Fedora
89
security advisorysecurity issueFedoraFedora 26 FEDORA-2018-4e657bf5e3 Critical: Sharutils Heap Overflow
This release fixes a heap buffer overflow when processing a shar archive by unshar tool if the arhive contains overlong lines.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-4e657bf5e3 2018-03-06 17:26:39.510865 --------------------------------------------------------------------------------Name : sharutils Product : Fedora 26 Version : 4.15.2 Release : 6.fc26 URL : http://www.gnu.org/software/sharutils/ Summary : The GNU shar utilities for packaging and unpackaging shell archives Description : The sharutils package contains the GNU shar utilities, a set of tools for encoding and decoding packages of files (in binary or text format) in a special plain text format called shell archives (shar). This format can be sent through e-mail (which can be problematic for regular binary files). The shar utility supports a wide range of capabilities (compressing, uuencoding, splitting long files for multi-part mailings, providing check-sums), which make it very flexible at creating shar files. After the files have been sent, the unshar tool scans mail messages looking for shar files. Unshar automatically strips off mail headers and introductory text and then unpacks the shar files. --------------------------------------------------------------------------------Update Information: This release fixes a heap buffer overflow when processing a shar archive by unshar tool if the arhive contains overlong lines. --------------------------------------------------------------------------------References: [ 1 ] Bug #1548018 - sharutils: heap-buffer-overflow in find_archive in unshar.c https://bugzilla.redhat.com/show_bug.cgi?id=1548018 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade sharutils' at the command line. For more information, refer to the dnf documentationavailable at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Mar 06, 2018
•Critical
Fedora
89
security advisoryupdatecriticalFedora 26: 2018-4e657bf5e3 Critical Heap Overflow in Sharutils
This release fixes a heap buffer overflow when processing a shar archive by unshar tool if the arhive contains overlong lines.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-4e657bf5e3 2018-03-06 17:26:39.510865 --------------------------------------------------------------------------------Name : sharutils Product : Fedora 26 Version : 4.15.2 Release : 6.fc26 URL : http://www.gnu.org/software/sharutils/ Summary : The GNU shar utilities for packaging and unpackaging shell archives Description : The sharutils package contains the GNU shar utilities, a set of tools for encoding and decoding packages of files (in binary or text format) in a special plain text format called shell archives (shar). This format can be sent through e-mail (which can be problematic for regular binary files). The shar utility supports a wide range of capabilities (compressing, uuencoding, splitting long files for multi-part mailings, providing check-sums), which make it very flexible at creating shar files. After the files have been sent, the unshar tool scans mail messages looking for shar files. Unshar automatically strips off mail headers and introductory text and then unpacks the shar files. --------------------------------------------------------------------------------Update Information: This release fixes a heap buffer overflow when processing a shar archive by unshar tool if the arhive contains overlong lines. --------------------------------------------------------------------------------References: [ 1 ] Bug #1548018 - sharutils: heap-buffer-overflow in find_archive in unshar.c https://bugzilla.redhat.com/show_bug.cgi?id=1548018 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade sharutils' at the command line. For more information, refer to the dnf documentationavailable at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Mar 06, 2018
•Critical
Fedora
200
security advisorysecurity issuelow severityScientific Linux: 2005:377-01 Low: Sharutils Security Update Alert
Low: sharutils security update. Date: Fri, 13 May 2005 16:13:11 -0500 Reply-To: Connie Sieh Sender: Security Errata for Scientific Linux From: Connie Sieh Subject: ERRATA for SL 302 ia64 now available Comments: To:
May 13, 2005
•Low
Scientific Linux
98
security advisorymoderatebuffer overflowRed Hat: RHSA-2005:378-01 Moderate: Sharutils Buffer Overflow Risk
An updated sharutils package is now available. This update has been rated as having low security impact by the Red Hat Security Response Team.. - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Low: sharutils security update Advisory ID: RHSA-2005:377-01 Advisory URL: https://access.redhat.com/errata/RHSA-2005:377.html Issue date: 2005-04-26 Updated on: 2005-04-26 Product: Red Hat Enterprise Linux CVE Names: CAN-2004-1772 CAN-2004-1773 CAN-2005-0990 - ---------------------------------------------------------------------1. Summary: An updated sharutils package is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. 2. Problem description: The sharutils package contains a set of tools for encoding and decoding packages of files in binary or text format. A stack based overflow bug was found in the way shar handles the -o option. If a user can be tricked into running a specially crafted command, it could lead to arbitrary code execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1772 to this issue. Please note that this issue does not affect Red Hat Enterprise Linux 4. Two buffer overflow bugs were found in sharutils. If an attacker can place a malicious 'wc' command on a victim's machine, or trick a victim into running a specially crafted command, it could lead to arbitrary code execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1773 to this issue. A bug was found in the way unshar creates temporary files. A local user could use symlinks to overwrite arbitrary files the victim running unshar has write access to. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0990 to this issue. All users of sharutils should upgrade to thisupdated package, which includes backported fixes to correct these issues. 3. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/ 4. Bug IDs fixed (http://bugzilla.redhat.com/): 152571 - CAN-2004-1772 buffer overflow with -o option 152573 - CAN-2004-1773 Buffer overflows in unshar 154049 - CAN-2005-0990 insecure temp file usage 5. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1: SRPMS: 4ff9ccec228d473e8983f60cec4f7bba sharutils-4.2.1-8.9.x.src.rpm i386: a11c9f7ce6ec7e339554f88dd586ca53 sharutils-4.2.1-8.9.x.i386.rpm ia64: c80d5a08b52b452b2c11cb7b0dffc59b sharutils-4.2.1-8.9.x.ia64.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: 4ff9ccec228d473e8983f60cec4f7bba sharutils-4.2.1-8.9.x.src.rpm ia64: c80d5a08b52b452b2c11cb7b0dffc59b sharutils-4.2.1-8.9.x.ia64.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: 4ff9ccec228d473e8983f60cec4f7bba sharutils-4.2.1-8.9.x.src.rpm i386: a11c9f7ce6ec7e339554f88dd586ca53 sharutils-4.2.1-8.9.x.i386.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: 4ff9ccec228d473e8983f60cec4f7bba sharutils-4.2.1-8.9.x.src.rpm i386: a11c9f7ce6ec7e339554f88dd586ca53 sharutils-4.2.1-8.9.x.i386.rpm Red Hat Enterprise Linux AS version 3: SRPMS: 06a6b26786f3674b33280441417316c8 sharutils-4.2.1-16.2.src.rpm i386: 3228571c5d375ff8ae96e6f7bf00a046 sharutils-4.2.1-16.2.i386.rpm ia64: caa4872797cbb61cbb3d86c9bc6b9c17 sharutils-4.2.1-16.2.ia64.rpm ppc: cf2564b18459cea9958c373396894ecc sharutils-4.2.1-16.2.ppc.rpm s390: ee6bb67d0ea5d5d79539437f78f1128f sharutils-4.2.1-16.2.s390.rpm s390x: 89114c0f739d46695fa787f3227a960c sharutils-4.2.1-16.2.s390x.rpm x86_64: 337510c9c7925ed4e916b2733059d35d sharutils-4.2.1-16.2.x86_64.rpm Red Hat Desktop version 3: SRPMS: 06a6b26786f3674b33280441417316c8 sharutils-4.2.1-16.2.src.rpm i386: 3228571c5d375ff8ae96e6f7bf00a046 sharutils-4.2.1-16.2.i386.rpm x86_64: 337510c9c7925ed4e916b2733059d35d sharutils-4.2.1-16.2.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: 06a6b26786f3674b33280441417316c8 sharutils-4.2.1-16.2.src.rpm i386: 3228571c5d375ff8ae96e6f7bf00a046 sharutils-4.2.1-16.2.i386.rpm ia64: caa4872797cbb61cbb3d86c9bc6b9c17 sharutils-4.2.1-16.2.ia64.rpm x86_64: 337510c9c7925ed4e916b2733059d35d sharutils-4.2.1-16.2.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: 06a6b26786f3674b33280441417316c8 sharutils-4.2.1-16.2.src.rpm i386: 3228571c5d375ff8ae96e6f7bf00a046 sharutils-4.2.1-16.2.i386.rpm ia64: caa4872797cbb61cbb3d86c9bc6b9c17 sharutils-4.2.1-16.2.ia64.rpm x86_64: 337510c9c7925ed4e916b2733059d35d sharutils-4.2.1-16.2.x86_64.rpm Red Hat Enterprise Linux AS version 4: SRPMS: fb0f041f40c952667fa9e2415bb95481 sharutils-4.2.1-22.2.src.rpm i386: 5528e7145b01b940474eed14da1a4bf5 sharutils-4.2.1-22.2.i386.rpm ia64: 14609e1cd1f1d403ad562a27ff7090d0 sharutils-4.2.1-22.2.ia64.rpm ppc: 83ae1ab7519ccd7905256da2319e006e sharutils-4.2.1-22.2.ppc.rpm s390: f81531770bdd340cf5bd39ebed7c211b sharutils-4.2.1-22.2.s390.rpm s390x: c68d22a3a01ad42d71b7d34b35a49896 sharutils-4.2.1-22.2.s390x.rpm x86_64: 96fa0ac9f458ea3bed71aca056478e91 sharutils-4.2.1-22.2.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: fb0f041f40c952667fa9e2415bb95481 sharutils-4.2.1-22.2.src.rpm i386: 5528e7145b01b940474eed14da1a4bf5 sharutils-4.2.1-22.2.i386.rpm x86_64: 96fa0ac9f458ea3bed71aca056478e91 sharutils-4.2.1-22.2.x86_64.rpm Red HatEnterprise Linux ES version 4: SRPMS: fb0f041f40c952667fa9e2415bb95481 sharutils-4.2.1-22.2.src.rpm i386: 5528e7145b01b940474eed14da1a4bf5 sharutils-4.2.1-22.2.i386.rpm ia64: 14609e1cd1f1d403ad562a27ff7090d0 sharutils-4.2.1-22.2.ia64.rpm x86_64: 96fa0ac9f458ea3bed71aca056478e91 sharutils-4.2.1-22.2.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: fb0f041f40c952667fa9e2415bb95481 sharutils-4.2.1-22.2.src.rpm i386: 5528e7145b01b940474eed14da1a4bf5 sharutils-4.2.1-22.2.i386.rpm ia64: 14609e1cd1f1d403ad562a27ff7090d0 sharutils-4.2.1-22.2.ia64.rpm x86_64: 96fa0ac9f458ea3bed71aca056478e91 sharutils-4.2.1-22.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 6. References: https://www.cve.org/CVERecord?id=CVE-CAN-2004-1772 https://www.cve.org/CVERecord?id=CVE-CAN-2004-1773 https://www.cve.org/CVERecord?id=CVE-CAN-2005-0990 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2005 Red Hat, Inc. . The recent enhancement for the sharutils toolkit resolves problems classified with low urgency by Red Hat Security.. sharutils Update, Code Execution Threat, Red Hat Advisory. . Severity: Low. LinuxSecurity.com Team
Apr 26, 2005
•Low
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!