SUSE-SU-2021:2834-1

Описание

This update for unrar to version 5.6.1 fixes several issues.

These security issues were fixed:

• CVE-2017-12938: Prevent remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file (bsc#1054038).
• CVE-2017-12940: Prevent out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function (bsc#1054038).
• CVE-2017-12941: Prevent an out-of-bounds read in the Unpack::Unpack20 function (bsc#1054038).
• CVE-2017-12942: Prevent a buffer overflow in the Unpack::LongLZ function (bsc#1054038).
• CVE-2017-20006: Fixed heap-based buffer overflow in Unpack:CopyString (bsc#1187974).

These non-security issues were fixed:

• Added extraction support for .LZ archives created by Lzip compressor
• Enable unpacking of files in ZIP archives compressed with XZ algorithm and encrypted with AES
• Added support for PAX extended headers inside of TAR archive
• If RAR recovery volumes (.rev files) are present in the same folder as usual RAR volumes, archive test command verifies .rev contents after completing testing .rar files
• By default unrar skips symbolic links with absolute paths in link target when extracting unless -ola command line switch is specified
• Added support for AES-NI CPU instructions
• Support for a new RAR 5.0 archiving format
• Wildcard exclusion mask for folders
• Prevent conditional jumps depending on uninitialised values (bsc#1046882)