Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the bsdtar package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

openSUSE Security Update : build (openSUSE-SU-2011:0174-1)

The build script uses cpio to extract untrusted rpm packages for bootstrapping virtual machines. cpio is not safe to use for this task, therefore the build script now uses bsdtar instead CVE-2010-4226. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Debian DSA-2413-1 : libarchive - buffer overflows

Two buffer overflows have been discovered in libarchive, a library providing a flexible interface for reading and writing archives in various formats. The possible buffer overflows while reading ISO 9660 or tar streams allow remote attackers to execute arbitrary code depending on the application...

SuSE 10 Security Update : build (ZYPP Patch Number 7395)

The build script uses cpio to extract untrusted rpm packages for bootstrapping virtual machines. cpio is not safe to use for this task, therefore the build script now uses bsdtar instead. CVE-2010-4226 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

openSUSE Security Update : build (openSUSE-SU-2011:0174-1)

The build script uses cpio to extract untrusted rpm packages for bootstrapping virtual machines. cpio is not safe to use for this task, therefore the build script now uses bsdtar instead CVE-2010-4226. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

SuSE 10 Security Update : build (ZYPP Patch Number 7372)

The build script uses cpio to extract untrusted rpm packages for bootstrapping virtual machines. cpio is not safe to use for this task, therefore the build script now uses bsdtar instead. CVE-2010-4226 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

FreeBSD-SA-07:10.gtar

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-07:10.gtar Security Advisory The FreeBSD Project Topic: gtar directory traversal vulnerability Category: contrib Module: contribtar Announced: 2007-11-29 Credits:...

openSUSE 10 Security Update : libarchive (libarchive-3982)

Specially crafted tar-archives could cause programs based on libarchive to crash, to run into an enless loop or potentially to even execute arbitrary code CVE-2007-3641, CVE-2007-3644, CVE-2007-3645. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

FreeBSD-SA-06:26.gtar

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-06:26.gtar Security Advisory The FreeBSD Project Topic: gtar name mangling symlink vulnerability Category: contrib Module: contribtar Announced: 2006-12-06...

gtar -- name mangling symlink vulnerability

Problem Description: Symlinks created using the "GNUTYPENAMES" tar extension can be absolute due to lack of proper sanity checks. Impact: If an attacker can get a user to extract a specially crafted tar archive the attacker can overwrite arbitrary files with the permissions of the user running...