arj - security update

Multiple vulnerabilities have been discovered in arj, an open source
version of the arj archiver. The Common Vulnerabilities and Exposures
project identifies the following problems:

• CVE-2015-0556
  Jakub Wilk discovered that arj follows symlinks created during
  unpacking of an arj archive. A remote attacker could use this flaw
  to perform a directory traversal attack if a user or automated
  system were tricked into processing a specially crafted arj archive.
• CVE-2015-0557
  Jakub Wilk discovered that arj does not sufficiently protect from
  directory traversal while unpacking an arj archive containing file
  paths with multiple leading slashes. A remote attacker could use
  this flaw to write to arbitrary files if a user or automated system
  were tricked into processing a specially crafted arj archive.
• CVE-2015-2782
  Jakub Wilk and Guillem Jover discovered a buffer overflow
  vulnerability in arj. A remote attacker could use this flaw to cause
  an application crash or, possibly, execute arbitrary code with the
  privileges of the user running arj.

For the stable distribution (wheezy), these problems have been fixed in
version 3.10.22-10+deb7u1.

For the upcoming stable distribution (jessie), these problems have been
fixed in version 3.10.22-13.

For the unstable distribution (sid), these problems have been fixed in
version 3.10.22-13.

We recommend that you upgrade your arj packages.