--------------------------------------------------------------------- Fedora Legacy Test Update Notification FEDORALEGACY-2005-158801 Bugzilla https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=158801 2005-10-25 --------------------------------------------------------------------- Name : bzip2 Versions : rh73: bzip2-1.0.2-2.2.73.legacy Versions : rh9: bzip2-1.0.2-8.1.90.legacy Versions : fc1: bzip2-1.0.2-10.1.fc1.legacy Versions : fc2: bzip2-1.0.2-12.2.fc2.legacy Summary : A file compression utility. Description : Bzip2 is a freely available, patent-free, high-quality data compressor that uses the same command line flags as gzip. --------------------------------------------------------------------- Update Information: Updated bzip2 packages that fix multiple issues are now available. Bzip2 is a data compressor. A bug was found in the way bzgrep processes file names. If a user can be tricked into running bzgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running bzgrep. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0758 to this issue. A bug was found in the way bzip2 modifies file permissions during decompression. If an attacker has write access to the directory into which bzip2 is decompressing files, it is possible for them to modify permissions on files owned by the user running bzip2 (CAN-2005-0953). A bug was found in the way bzip2 decompresses files. It is possible for an attacker to create a specially crafted bzip2 file which will cause bzip2 to cause a denial of service (by filling disk space) if decompressed by a victim (CAN-2005-1260). Users of Bzip2 should upgrade to these updated packages, which contain backported patches to correct these issues. --------------------------------------------------------------------- Changelogs rh73: * Tue Sep 06 2005 David Eisenstein <deisenst@xxxxxxx> 1.0.2-2.2.73.legacy - changed the bzgrep patch to match RHEL 3's. (per bug 158801#c6) - added tempfile patch so bzdiff/bzcmp creates tempfiles more securely (from RHEL 3). Also added 2/24 & 3/30/05 changelog items. - added CVE and bugzilla bug numbers to next 4 changelog items. - renumbered release from "13.1.73.legacy" to "2.2.73.legacy" in keeping with FL package versioning scheme. * Thu Jun 16 2005 Michal Jaegermann <michal@xxxxxxxxxxxx> - resynchronized for rhl7.3 with bzip2-1.0.2-13.FC3.1.src.rpm, #158801 rh9: * Tue Sep 06 2005 David Eisenstein <deisenst@xxxxxxx> 1.0.2-8.1.90.legacy - Recompiled for Red Hat 9.0. #158801. fc1: * Sat Sep 03 2005 David Eisenstein <deisenst@xxxxxxx> 1.0.2-10.1.fc1.legacy - Recompiled for Fedora Core 1. #158801. fc2: * Tue Sep 06 2005 David Eisenstein <deisenst@xxxxxxx> 1.0.2-12.2.fc2.legacy - Recompiled for Fedora Core 2. #158801. --------------------------------------------------------------------- This update can be downloaded from: http://download.fedoralegacy.org/ (sha1sums) rh73: 2d0d5267210ceefd6e2ed80187c2f6e3d994e4a0 redhat/7.3/updates-testing/i386/bzip2-1.0.2-2.2.73.legacy.i386.rpm e661f6bf518498c375918577fc3414978a190d78 redhat/7.3/updates-testing/i386/bzip2-devel-1.0.2-2.2.73.legacy.i386.rpm 0c1bd4a4472ca70183b104438db1a9ef98db4969 redhat/7.3/updates-testing/i386/bzip2-libs-1.0.2-2.2.73.legacy.i386.rpm f146cb7edfa74345c42831f24cb95c7898db3064 redhat/7.3/updates-testing/SRPMS/bzip2-1.0.2-2.2.73.legacy.src.rpm rh9: 36b3b8abb700fe93d14064ce22176ed59aef0b9b redhat/9/updates-testing/i386/bzip2-1.0.2-8.1.90.legacy.i386.rpm 3ce61caa59d4c9a90e2412ebd5bae76500e4e462 redhat/9/updates-testing/i386/bzip2-devel-1.0.2-8.1.90.legacy.i386.rpm 905c29052192f032dac84be0860013837b65f8d4 redhat/9/updates-testing/i386/bzip2-libs-1.0.2-8.1.90.legacy.i386.rpm bdbf201ea36551c1f5eacff3707656fd5e099c75 redhat/9/updates-testing/SRPMS/bzip2-1.0.2-8.1.90.legacy.src.rpm fc1: 56b7883ada43718a80577ddcbdbc8bc24072765d fedora/1/updates-testing/i386/bzip2-1.0.2-10.1.fc1.legacy.i386.rpm 472cee03d32c68e0a0feba56a265c42d208ea5d4 fedora/1/updates-testing/i386/bzip2-devel-1.0.2-10.1.fc1.legacy.i386.rpm 94abc962a1b84373813c558d4d3d44993722bb16 fedora/1/updates-testing/i386/bzip2-libs-1.0.2-10.1.fc1.legacy.i386.rpm 7ce97f2488338b9d0e4b136b63c04e80c7a27394 fedora/1/updates-testing/SRPMS/bzip2-1.0.2-10.1.fc1.legacy.src.rpm fc2: c2821d2326bdff302a8b38ab6baec2930da4ca6b fedora/2/updates-testing/i386/bzip2-1.0.2-12.2.fc2.legacy.i386.rpm d1ba1f61d62970f0d97af8813956771b471fbc81 fedora/2/updates-testing/i386/bzip2-devel-1.0.2-12.2.fc2.legacy.i386.rpm c8cf989f3683f4313d4a0caf7695673f48e405e7 fedora/2/updates-testing/i386/bzip2-libs-1.0.2-12.2.fc2.legacy.i386.rpm 1ac418e19c22613a3cc4d71ee304a9d304af50e6 fedora/2/updates-testing/SRPMS/bzip2-1.0.2-12.2.fc2.legacy.src.rpm --------------------------------------------------------------------- Please test and comment in bugzilla.
Attachment:
signature.asc
Description: OpenPGP digital signature
-- fedora-legacy-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-legacy-list
