[Technik] [SECURITY] [DSA 1522-1] New unzip packages fix potential code execution

[Noèl Köthe]

Am Montag, den 17.03.2008, 21:03 +0100 schrieb Florian Weimer:

> Debian Security Advisory DSA-1522-1                security at debian.org
> http://www.debian.org/security/                         Florian Weimer
> March 17, 2008                     http://www.debian.org/security/faq
> 
> Package        : unzip
> Vulnerability  : programming error
> Problem type   : local
> Debian-specific: no
> CVE Id(s)      : CVE-2008-0888

unzip auf h01, h02, h03, h04, h51, h52, wasco, cupa und cree
aktualisiert.

> For the stable distribution (etch), this problem has been fixed in
> version 5.52-9etch1.

changelog:
unzip (5.52-9etch1) stable-security; urgency=high

  * Apply patch from Tavis Ormandy to address invalid free() calls in
    the inflate_dynamic() function (CVE-2008-0888).

 -- Florian Weimer <fw at deneb.enyo.de>  Sun, 16 Mar 2008 11:42:07 +0100

> For the old stable distribution (sarge), this problem has been fixed
> in version 5.52-1sarge5.

changelog:
unzip (5.52-1sarge5) oldstable-security; urgency=high

  * Apply patch from Tavis Ormandy to address invalid free() calls in
    the inflate_dynamic() function (CVE-2008-0888).

 -- Florian Weimer <fw at deneb.enyo.de>  Sun, 16 Mar 2008 11:52:16 +0100

-- 
Noèl Köthe <noel debian.org>
Debian GNU/Linux, www.debian.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Dies ist ein digital signierter Nachrichtenteil
Url : /archiv/technik/attachments/20080319/6fc3089b/attachment.pgp