SUSE-SU-2018:0862-1 -- SLES unrarID: oval:org.secpod.oval:def:89002273 | Date: (C)2021-02-26 (M)2022-10-10 |
Class: PATCH | Family: unix |
This update for unrar to version 5.6.1 fixes several issues. These security issues were fixed: - CVE-2017-12938: Prevent remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file . - CVE-2017-12940: Prevent out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function . - CVE-2017-12941: Prevent an out-of-bounds read in the Unpack::Unpack20 function . - CVE-2017-12942: Prevent a buffer overflow in the Unpack::LongLZ function . These non-security issues were fixed: - Added extraction support for .LZ archives created by Lzip compressor - Enable unpacking of files in ZIP archives compressed with XZ algorithm and encrypted with AES - Added support for PAX extended headers inside of TAR archive - If RAR recovery volumes are present in the same folder as usual RAR volumes, archive test command verifies .rev contents after completing testing .rar files - By default unrar skips symbolic links with absolute paths in link target when extracting unless -ola command line switch is specified - Added support for AES-NI CPU instructions - Support for a new RAR 5.0 archiving format - Wildcard exclusion mask for folders - Added libunrar* and libunrar*-devel subpackages - Prevent conditional jumps depending on uninitialised values
Platform: |
SUSE Linux Enterprise Server 11 SP4 |