lp:ubuntu/dapper-updates/tar
- Get this branch:
- bzr branch lp:ubuntu/dapper-updates/tar
Branch merges
Branch information
Recent revisions
- 10. By Jamie Strandboge
-
* SECURITY UPDATE: stack-based buffer overflow with malicious tar files
- src/names.c: updated src/names.c to rewrite hash_string_prefix as
hash_string_ insert_ prefix and adjust safer_name_suffix to use
hash_string_ insert_ prefix to avoid stack allocation
- patch from upstream paxlib commits:
http://git.savannah. gnu.org/ gitweb/ ?p=paxutils. git;a=commitdif f;h=b9199bbdefd 32382953dd8c01e c881e5463c5a88
http://git.savannah. gnu.org/ gitweb/ ?p=paxutils. git;a=commitdif f;h=64379227940 699a92113e3fd7c 583e705a1f849b
- CVE-2007-4476
- LP: #180299
* adjust tests/pipe.at pipe the output from `tar xfv' through sort and
regenerate tests/testsuite with autom4ke to get tests working again (how
did it ever successfully build before?) - 9. By Kees Cook
-
* SECURITY UPDATE: directory traversal with malicious tar files.
* src/names.c: adjust dot dot checking, patched inline.
* References
CVE-2007-4131 - 8. By Kees Cook
-
* SECURITY UPDATE: files can be overwritten/renamed in any writable location
in the filesystem via GNUTYPE_NAMES type.
* src/extract.c: disable GNUTYPE_NAMES type processing by default since it
allows for immediate symlink creation and renames.
* src/common.h, src/tar.c: add --allow-name-mangling option to restore
default behavior.
* References
http://archives. neohapsis. com/archives/ fulldisclosure/ 2006-11/ 0344.html - 6. By Martin Pitt
-
* SECURITY UPDATE: Arbitrary code execution with crafted tar files.
* src/xheader.c:
- Add a new function decode_num() which wraps xstrtoumax() and adds
boundary and sanity checking.
- Use decode_num() instead of xstrtoumax() in the code to avoid buffer
overflows on excessively large field values like GNU.sparse.numblocks.
- Patch taken from upstream CVS.
* CVE-2006-0300 - 5. By Bdale Garbee
-
* patch from LaMont to fix gcc-4.0 error in the test suite,
closes: #308815, #310830
* patch for de.po from Jens Seidel, closes: #313900
* fix amanda upstream URL in the info pages, closes: #310158
* patch from NIIBE Yutaka to support cross builds, closes: #283723 - 4. By Bdale Garbee
-
* patch from Paul Eggert that does a better job of eliminating the
dependency on (buggy) valloc, closes: #234422, #248897
* patch for typo in upstream po/de.po, closes: #154511
* switch from dh_installmanpages to dh_installman - 3. By Bdale Garbee
-
* patch to stop issuing lone zero block warnings, closes: #235820
* patch to clean up hyphenation in man page, closes: #185670
* clean up manpage discussion of exclude and exclude-from, closes: #146196
* turn on regression tests in the build process - 2. By Bdale Garbee
-
* add a README.Debian that clarifies the situation with respect to 'compress'
in Debian and the impact on the -Z and related options, closes: #122336
* patch from Mark Eichin to fix archive corruption in special cases, which
has been accepted upstream for next release. closes: #126274
Branch metadata
- Branch format:
- Branch format 7
- Repository format:
- Bazaar repository format 2a (needs bzr 1.16 or later)
- Stacked on:
- lp:ubuntu/karmic/tar