Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1102826 > unrolled thread
| Started by | yokota <yokota.hgml@gmail.com> |
|---|---|
| First post | 2022-05-11 19:40 +0200 |
| Last post | 2022-05-29 20:10 +0200 |
| Articles | 4 — 3 participants |
Back to article view | Back to linux.debian.bugs.dist
Bug#1010857: bullseye-pu: package unrar-nonfree/1:6.0.3-1+deb11u1 yokota <yokota.hgml@gmail.com> - 2022-05-11 19:40 +0200
Bug#1010857: bullseye-pu: package unrar-nonfree/1:6.0.3-1+deb11u1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2022-05-28 21:50 +0200
Bug#1010857: bullseye-pu: package unrar-nonfree/1:6.0.3-1+deb11u1 yokota <yokota.hgml@gmail.com> - 2022-05-29 06:10 +0200
Bug#1010857: unrar-nonfree 6.0.3-1+deb11u1 flagged for acceptance Adam D Barratt <adam@adam-barratt.org.uk> - 2022-05-29 20:10 +0200
| From | yokota <yokota.hgml@gmail.com> |
|---|---|
| Date | 2022-05-11 19:40 +0200 |
| Subject | Bug#1010857: bullseye-pu: package unrar-nonfree/1:6.0.3-1+deb11u1 |
| Message-ID | <ElYtA-eNTP-5@gated-at.bofh.it> |
[Multipart message — attachments visible in raw view] — view raw
Package: release.debian.org Severity: normal Tags: bullseye User: release.debian.org@packages.debian.org Usertags: pu X-Debbugs-Cc: yokota.hgml@gmail.com [ Reason ] Fix CVE-2022-30333 and its corresponding RC bug. [ Impact ] CVE-2022-30333 is directory traversal vulnerability. It write to files during an extract operation on outside of extraction directory. [ Tests ] Compiled executable file passes current autopkgtest in Debian sid. [ Risks ] Test case of CVE-2022-30333 is not available. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] Add patch to fix CVE-2022-30333. This patch was taken from diff file between unrar 6.1.6 and 6.1.7. [ Other info ] Upstream developer uses both application version and source version. Upstream says this security vulnerability is fixed in application version 6.12. Application version 6.12's corresponding source version is 6.1.7. CVE-2022-30333 was fixed in source version 6.1.7. -- YOKOTA Hiroshi
[toc] | [next] | [standalone]
| From | "Adam D. Barratt" <adam@adam-barratt.org.uk> |
|---|---|
| Date | 2022-05-28 21:50 +0200 |
| Message-ID | <EsaBH-Xnw-13@gated-at.bofh.it> |
| In reply to | #1102826 |
Control: tags -1 + confirmed On Thu, 2022-05-12 at 02:31 +0900, yokota wrote: > Fix CVE-2022-30333 and its corresponding RC bug. > > [ Impact ] > CVE-2022-30333 is directory traversal vulnerability. > It write to files during an extract operation on outside of > extraction > directory. > Please go ahead. Regards, Adam
[toc] | [prev] | [next] | [standalone]
| From | yokota <yokota.hgml@gmail.com> |
|---|---|
| Date | 2022-05-29 06:10 +0200 |
| Message-ID | <Esipz-127l-1@gated-at.bofh.it> |
| In reply to | #1104745 |
> > Fix CVE-2022-30333 and its corresponding RC bug. ... > Please go ahead. Thanks. I was uploaded unrar-nonfree/1:6.0.3-1+deb11u1 to bullseye. -- YOKOTA Hiroshi
[toc] | [prev] | [next] | [standalone]
| From | Adam D Barratt <adam@adam-barratt.org.uk> |
|---|---|
| Date | 2022-05-29 20:10 +0200 |
| Subject | Bug#1010857: unrar-nonfree 6.0.3-1+deb11u1 flagged for acceptance |
| Message-ID | <Esvwu-1aaw-51@gated-at.bofh.it> |
| In reply to | #1102826 |
package release.debian.org tags 1010857 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details ============== Package: unrar-nonfree Version: 6.0.3-1+deb11u1 Explanation: fix directory traversal issue [CVE-2022-30333]
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.bugs.dist
csiph-web