bugtraq - [SECURITY] [DSA 3111-1] cpio security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1Y3Dl0-00057p-61@alpha.psidef.org>
Date: Mon, 22 Dec 2014 19:55:26 -0500
From: Michael Gilbert <mgilbert@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3111-1] cpio security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3111-1                   security@...ian.org
http://www.debian.org/security/                           Michael Gilbert
December 22, 2014                      http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : cpio
CVE ID         : CVE-2014-9112
Debian Bug     : 772793

Michal Zalewski discovered an out of bounds write issue in cpio, a tool
for creating and extracting cpio archive files.  In the process of
fixing that issue, the cpio developers found and fixed additional
range checking and null pointer dereference issues.

For the stable distribution (wheezy), this problem has been fixed in
version 2.11+dfsg-0.1+deb7u1.

For the upcoming stable distribution (jessie), this problem will be
fixed soon.

For the unstable distribution (sid), this problem has been fixed in
version 2.11+dfsg-4.

We recommend that you upgrade your cpio packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQQcBAEBCgAGBQJUmLzoAAoJELjWss0C1vRzf7QgAIy/vBsx1WbBoO1ntcCB3QWT
ThCFDW84kFyJhXt08VGSZyAV/ywDLxx5Njdd9JG02ZS3cq7FRHkXs5PlI8R04t9x
SQOhrNVIvOGZ5+USewDcXphGkJ1RYZX3jg67Cj89v9ELJZxG9g9OKGKg2jTM0wVZ
dhBZFuMt0lUsXlG9mms8Kzg/Wqdt23K0kpG0zRPB3G8WKGVvqZuFPc4LWMfI2lMp
vv150qEOD37S8rsXzZdELrrDt5ERQFmvR5BYrhWMsmyAA3HmpLsWCxj1zIvQCRMQ
jeYfU92LQW0fzgl4DtDdGXJhnpH47IPt1VK7gAOhUB8tXH/zLRU/96JDaRiyqvn+
ClbtmUebLkK/OcB3KjXWUcnum5xDTrh+9ba/4OJppZifpcXgHkB2rnaqClBcVTm2
CZYtlZNPzCMofMkY0ZB79lRvleXJ2vUtDBeokqe4IAc5pB3eGIDov6PCRTYgggwe
WCfCKx+k/WrT5sGGPAiFXjbJXmRIrBmqzoDrQQgZ98r+bQmDCOhEfWW4bd0InwfE
lc3RkslRWuMiKl3hz0k0tE6kG02r2TC/PkNK2PXZXJDFfcvJkfSMZgcdkw2rRNvv
aWG2V7EKMrupM7vlxMhPVOBCidNbx/Kvj7zLXWWnTkyIwQPgBHEEQ84N0uPk4Ow+
Zx9GIItLVfRbF/4+wa06E6xK5lSFI6frvxiS08hXuCWw77/0ilfARo7HjkSs4uBZ
zyS8YshxW3S74gKqC6QOwxH8+3Z3Y611hcMLeAnjtTK+LsolSlEE7ep88LHNLAfz
yjKTqcPWEAa/BKpysTHNKOL4sNG0ZTmXylx9BFkF3guQsCTyp1cJSxW7mfQ0AQwT
sZHAaQvU8SflIAyXAGL34Qi1IU+bE4OaIsh5ltf1PaoJDIpdkQjAjG0nAoV2IrIR
Qxdh8hggPln38vmDbj5/VyDa3895iu3djHlfMBUvpqcsiJpdHbPFHwgWQczFIjHx
OmSIavnJuny5LcUZFMiz7T9fXvLDMNXhtaBe0yUnUO5ys69uYrcM8g4aobGidP4Q
Wl6ZIfv/JfiCYmW+vMZd1Ckjd9A9ApnVNwnwo2eZs5/zoK98glJpEv3ZKfwne+lF
RWOE6J/hmzyIX0pz+V+XdXP9voEELsOo3xHIYd443hUkI8jANV5/ivifhFrHhndr
PIrUFKpzBupkRCMg3Nua6RM0VxEunyzNk32Ac1iB282Pm8GwOqbvl04io8+JidXt
mu5Toop5XI+PMQDUSK18cE+LxwcM4DdE0J6rE1cM9m1ub975yi4ZB4yXglzEbxra
ecDtfyB0Ygg0aStwPplnGZ+JcJb0RdhmzmZEflJ+NMM+h2eRpbF3Y9VMM9Cu/Dg=
=9vV8
-----END PGP SIGNATURE-----