20:02 Christian Weisgerber (naddy) 

archivers/gcpio: update to 2.14

User-visible changes:
* New option --ignore-dirnlink
* The --reproducible option now implies --ignore-dirlink

    9a5c058d

21:30 naddy 

Remove superfluous declaration to fix build with -fno-common.

Reported by:	pkg-fallout
Obtained from:	upstream

 

22:47 naddy 

Security update to 2.13:
* Fix CVE-2015-1197
* Fix CVE-2016-2037
* Fix CVE-2019-14866
* Remove --extract-over-symlinks option again, which was part of an earlier
  third-party fix for CVE-2015-1197.

Security:	f59af308-07f3-11ea-8c56-f8b156b6dcc8

 

20:15 naddy 

Update to 2.12, but retain local fix for CVE-2015-1197.

 

14:29 naddy 

CVE-2014-9112: Heap-based buffer overflow in the process_copy_in
function allows remote attackers to cause a denial of service via
a large block value in a cpio archive.
Fix from a series of upstream commits by Sergey Poznyakoff.

CVE-2015-1197: cpio, when using the --no-absolute-filenames option,
allows local users to write to arbitrary files via a symlink attack
on a file in an archive.
Fix from Vitezslav Cizek after 3.5 years of gestation in the SUSE
bug tracker.

PR:		198954
Obtained from:	Debian