• [SECURITY] [DSA 3386-1] unzip security update

    From Laszlo Boszormenyi (GCS)@1:229/2 to All on Sat Oct 31 15:40:01 2015
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-3386-1 [email protected] https://www.debian.org/security/ Laszlo Boszormenyi (GCS) October 31, 2015 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : unzip
    CVE ID : CVE-2015-7696 CVE-2015-7697
    Debian Bug : 802160 802162

    Two vulnerabilities have been found in unzip, a de-archiver for .zip
    files. The Common Vulnerabilities and Exposures project identifies the following problems:

    CVE-2015-7696

    Gustavo Grieco discovered that unzip incorrectly handled certain
    password protected archives. If a user or automated system were
    tricked into processing a specially crafted zip archive, an attacker
    could possibly execute arbitrary code.

    CVE-2015-7697

    Gustavo Grieco discovered that unzip incorrectly handled certain
    malformed archives. If a user or automated system were tricked into
    processing a specially crafted zip archive, an attacker could
    possibly cause unzip to hang, resulting in a denial of service.

    For the oldstable distribution (wheezy), these problems have been fixed
    in version 6.0-8+deb7u4.

    For the stable distribution (jessie), these problems have been fixed in
    version 6.0-16+deb8u1.

    For the testing distribution (stretch), these problems have been fixed
    in version 6.0-19.

    For the unstable distribution (sid), these problems have been fixed in
    version 6.0-19.

    We recommend that you upgrade your unzip packages.

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: [email protected]
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1

    iQIcBAEBCgAGBQJWNNHRAAoJEAVMuPMTQ89EvjgP/A6mLOMG2pXEfa/3WvpgmMe+ 7jA86FckGWadkhei42rPXdDsfvnDL/zZuKmgLmmRendL6kWJF2qjrqTnLoQdlVA/ oQhWqUGKMkCtdWNYEhdohU7JAjbfO9kd3/NohRX0gts4YMskGJzuFVpktUqHDrEZ pI8LJiHfLrO1QdkC91NC4ikB2shuppQVzUpbaJQPJI7/LWLX1k3AIc7DOd3YEAg9 MTuLChTahz/0hgb1cJnTyXwsSlOVWuuHiBsqUu5nx//NIAXRPnM3gwGTlfu8qviJ PrhQ6SSYP5jlyI05DrVUMEOjHXncs421W81HFjimQ1vvX53NmCLcOqJyTKbm5Ivc wr6MNlXrMIXICfKvZFJblqDGqoQ5dbtWGCoxciz+eIIJZ5XHXND3EA+k7e126MO2 Cbo4M51bqz8UWez/aNlCsRM/y+eXASyun4G/rk5lw7NCV84HPlVNRbetgRk8AD/P kDxmcjWGiQ8coLNnTQCAp76NC/uHhYmAnIPlaRx/r5v3252K1UwMRVqVBWh0TJhL IgJr/W1QvUlcfoudykcl+EXGBV2bypEagoYW1qCEu5PepyfOgC3TcWhf5IZrg82h X734kq2p0Xd8Rg0a3WYLig3sG4mnpgiPzqwsYDLk1wIxQfC53SwOHXHl/VusXMwT PI2zEAEef3Fqx15wRZcX
    =K/48
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)