Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
87
security advisorybuffer overflowDebianDebian: 752-4 Urgent: Unzip Memory Leak and Denial of Service Risks
Several vulnerabilities have been discovered in unarj, a non-free ARJ unarchive utility.. - --------------------------------------------------------------------------Debian Security Advisory DSA 652-1
Jan 21, 2005
•Important
Debian
98
security advisoryRed HatupdateRed Hat: RHSA-2005:007-01 Critical: Unarj Buffer Overflow Impact
An updated unarj package that fixes a buffer overflow vulnerability and a directory traversal vulnerability is now available.. - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Updated unarj package fixes security issue Advisory ID: RHSA-2005:007-01 Advisory URL: https://access.redhat.com/errata/RHSA-2005:007.html Issue date: 2005-01-12 Updated on: 2005-01-12 Product: Red Hat Enterprise Linux CVE Names: CAN-2004-0947 CAN-2004-1027 - ---------------------------------------------------------------------1. Summary: An updated unarj package that fixes a buffer overflow vulnerability and a directory traversal vulnerability is now available. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 3. Problem description: The unarj program is an archiving utility which can extract ARJ-compatible archives. A buffer overflow bug was discovered in unarj when handling long file names contained in an archive. An attacker could create a specially crafted archive which could cause unarj to crash or possibly execute arbitrary code when extracted by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0947 to this issue. Additionally, a path traversal vulnerability was discovered in unarj. An attacker could create a specially crafted archive which would create files in the parent ("..") directory when extracted by a victim. When used recursively, this vulnerability could be used to overwrite critical system files and programs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1027 to this issue. Users of unarj should upgrade to this updated package whichcontains backported patches and is not vulnerable to these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/ 5. Bug IDs fixed (http://bugzilla.redhat.com/): 138462 - CAN-2004-0947 buffer overflow in unarj 138835 - CAN-2004-1027 unarj directory traversal issue 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1: SRPMS: abb1c235036bd233c437b003a4dbb8c1 unarj-2.43-13.src.rpm i386: 1b3f6e7e8780f02a7b6038b78f3af8c2 unarj-2.43-13.i386.rpm ia64: 346187352a1792700194a7c7bd5de83f unarj-2.43-13.ia64.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: abb1c235036bd233c437b003a4dbb8c1 unarj-2.43-13.src.rpm ia64: 346187352a1792700194a7c7bd5de83f unarj-2.43-13.ia64.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: abb1c235036bd233c437b003a4dbb8c1 unarj-2.43-13.src.rpm i386: 1b3f6e7e8780f02a7b6038b78f3af8c2 unarj-2.43-13.i386.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: abb1c235036bd233c437b003a4dbb8c1 unarj-2.43-13.src.rpm i386: 1b3f6e7e8780f02a7b6038b78f3af8c2 unarj-2.43-13.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://www.cve.org/CVERecord?id=CAN-2004-0947 https://www.cve.org/CVERecord?id=CAN-2004-1027 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2005 Red Hat, Inc. . Urgent Debiansecurity notice tackles extensive vulnerabilities found in unarj utility. Ensure your system is patched immediately.. Red Hat Enterprise Linux, Unarj Update, Critical Security Advisory. . Severity: Critical. LinuxSecurity.com Team
Jan 12, 2005
•Critical
Red Hat
91
security advisoryGentoobuffer overflowGentoo: GLSA 200411-29 Normal Severity: Unarj Buffer Overflow
unarj contains a buffer overflow and a directory traversal vulnerability. This could lead to overwriting of arbitrary files or the execution of arbitrary code. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200411-29 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: unarj: Long filenames buffer overflow and a path traversal vulnerability Date: November 19, 2004 Bugs: #70966 ID: 200411-29 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= unarj contains a buffer overflow and a directory traversal vulnerability. This could lead to overwriting of arbitrary files or the execution of arbitrary code. Background ========= unarj is an ARJ archive decompressor. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-arch/unarj < 2.63a-r2 > = 2.63a-r2 Description ========== unarj has a bounds checking vulnerability within the handling of long filenames in archives. It also fails to properly sanitize paths when extracting an archive (if the "x" option is used to preserve paths). Impact ===== An attacker could trigger a buffer overflow or a path traversal by enticing a user to open an archive containing specially-crafted path names, potentially resulting in the overwrite of files or execution of arbitrary code with the permissions of the user running unarj. Workaround ========= There is no known workaround at this time. Resolution ========= All unarj users should upgrade to the latest version: # emerge --sync # emerge--ask --oneshot --verbose "> =app-arch/unarj-2.63a-r2" References ========= [ 1 ] CAN-2004-0947 https://www.cve.org/CVERecord?id=CAN-2004-0947 [ 2 ] CAN-2004-1027 https://www.cve.org/CVERecord?id=CAN-2004-1027 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200411-29 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Nov 19, 2004
Gentoo
89
security advisorybuffer overflowcriticalFedora Core 2 FEDORA-2004-414 Critical: Unarj Buffer Overflow Notice
A buffer overflow bug has been discovered in unarj when handling long file names contained in an archive. An attacker could create an archive with a specially crafted path which could cause unarj to crash or execute arbitrary instructions.. --------------------------------------------------------------------- Fedora Update Notification FEDORA-2004-414 2004-11-11 --------------------------------------------------------------------- Product : Fedora Core 2 Name : unarj Version : 2.63a Release : 7 Summary : An uncompressor for .arj format archive files. Description : The UNARJ program is used to uncompress .arj format archives. The .arj format archive was mostly used on DOS machines. Install the unarj package if you need to uncompress .arj format archives. --------------------------------------------------------------------- Update Information: A buffer overflow bug has been discovered in unarj when handling long file names contained in an archive. An attacker could create an archive with a specially crafted path which could cause unarj to crash or execute arbitrary instructions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0947 to this issue. Additionally, a path traversal vulnerability exists in unarj which allows an attacker to extract files to the parent ("..") directory. When used recursively, this vulnerability can be used to overwrite critical system files and programs. Users of unarj are advised to upgrade to these packages. --------------------------------------------------------------------- * Wed Nov 10 2004 Lon Hohberger 2.63a-7 - Fix directory traversal & buffer overflow. #138468 * Tue Jun 15 2004 Elliot Lee - rebuilt --------------------------------------------------------------------- This update can be downloaded from: 7cd2b05ac20893645d2d5307bec0bd44 SRPMS/unarj-2.63a-7.src.rpm 373d4ac8b936d388deeec2ef34195783 x86_64/unarj-2.63a-7.x86_64.rpm 8db05c7d97465cb809a520839799e69e x86_64/debug/unarj- debuginfo-2.63a-7.x86_64.rpm 663a0b4cfa78c48f54ed531ed4ec5404 i386/unarj-2.63a-7.i386.rpm dd4778dc2519de5b5dfb787a5f290ccf i386/debug/unarj- debuginfo-2.63a-7.i386.rpm This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command. --------------------------------------------------------------------- -- fedora-announce-list mailing list
Nov 11, 2004
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!