Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:14215-1

Опубликовано: 11 нояб. 2019
Источник: suse-cvrf

Описание

Security update for tar

This update for tar to version 1.27.1 fixes the following issues:

tar 1.27.1 brings following changes (jsc#ECO-339)

  • Sparse files with large data
  • No backticks in quoting
  • --owner and --group names and numbers
  • Support for POSIX ACLs, extended attributes and SELinux context.
  • Passing command line arguments to external commands.
  • New configure option --enable-gcc-warnings, intended for debugging.
  • New warning control option --warning=[no-]record-size
  • New command line option --keep-directory-symlink
  • Fix unquoting of file names obtained via the -T option.
  • Fix GNU long link header timestamp (backward compatibility).

Security issues fixed:

  • CVE-2019-9923: Fixed a denial of service while parsing certain archives with malformed extended headers in pax_decode_header() (bsc#1130496).
  • CVE-2018-20482: Fixed a denial of service when the '--sparse' option mishandles file shrinkage during read access (bsc#1120610).

Список пакетов

SUSE Linux Enterprise Point of Sale 11 SP3
tar-1.27.1-14.8.1
SUSE Linux Enterprise Server 11 SP4-LTSS
tar-1.27.1-14.8.1

Ссылки

Описание

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:tar-1.27.1-14.8.1
SUSE Linux Enterprise Server 11 SP4-LTSS:tar-1.27.1-14.8.1
Ссылки

Описание

pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:tar-1.27.1-14.8.1
SUSE Linux Enterprise Server 11 SP4-LTSS:tar-1.27.1-14.8.1
Ссылки