--------------------------------------------------------------------- Fedora Legacy Test Update Notification FEDORALEGACY-2004-2255 Bugzilla https://bugzilla.fedora.us/show_bug.cgi?id=2255 2004-12-18 ---------------------------------------------------------------------
Name : zip
7.3 Version : zip-2.3-26.1.0.7.3.legacy
9 Version : zip-2.3-26.1.0.9.legacy
fc1 Version : zip-2.3-26.1.1.legacy
Summary : A file compression and packaging utility compatible with
PKZIP.
Description :
The zip program is a compression and file packaging utility. Zip is
analogous to a combination of the UNIX tar and compress commands and
is compatible with PKZIP, a compression and file packaging utility for
MS-DOS systems.--------------------------------------------------------------------- Update Information:
An updated zip package that fixes a buffer overflow vulnerability is now available.
The zip program is an archiving utility which can create ZIP-compatible archives.
A buffer overflow bug has been discovered in zip when handling long file names. An attacker could create a specially crafted path which could cause zip to crash or execute arbitrary instructions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1010 to this issue.
Users of zip should upgrade to this updated package, which contains backported patches and is not vulnerable to this issue.
--------------------------------------------------------------------- 7.3 changelog:
* Mon Nov 08 2004 Lon Hohberger <lhh redhat com> 2.3-26.3 - Rebuild for FC-3
* Mon Nov 08 2004 Lon Hohberger <lhh redhat com> 2.3-26.2 - Fix buffer overflow. #138230
* Tue Nov 16 2004 Rob Myers <rob myers gtri gatech edu> 2.3-26.1.0.9.legacy - Rebuild for rh9 legacy - resolves CAN-2004-1010 (FL #2255)
* Mon Nov 08 2004 Lon Hohberger <lhh redhat com> 2.3-26.3 - Rebuild for FC-3
* Mon Nov 08 2004 Lon Hohberger <lhh redhat com> 2.3-26.2 - Fix buffer overflow. #138230
* Tue Nov 16 2004 Rob Myers <rob myers gtri gatech edu> 2.3-26.1.1.legacy - Rebuild for fc1 legacy - resolves CAN-2004-1010 (FL #2255)
* Mon Nov 08 2004 Lon Hohberger <lhh redhat com> 2.3-26.3 - Rebuild for FC-3
* Mon Nov 08 2004 Lon Hohberger <lhh redhat com> 2.3-26.2 - Fix buffer overflow. #138230
--------------------------------------------------------------------- This update can be downloaded from: http://download.fedoralegacy.org/ (sha1sums)
Attachment:
signature.asc
Description: OpenPGP digital signature