7182 2015-01-19 10:06:01 +0000 pigz, pax, cpio : directory traversal vulnerabilities, multiple CVEs 2015-04-01 01:34:42 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core unspecified All Multiple RESOLVED FIXED Medium normal 1.8 M4 1 sona.sarmadi liezhi.yang liezhi.yang meta.mr.watcher meta.watcher --- --- No (bug/feature does not impact docs) oldest_to_newest 48025 0 sona.sarmadi 2015-01-19 10:06:01 +0000 Three cases of directory traversal in archiving utilities: pigz, CVE-2015-1191 pigz is susceptible to directory traversal vulnerabilities. While decompressing a file with restoring file name, it (unlike gzip) will happily use absolute and relative paths taken from the input. This can be exploited by a malicious archive to write files outside the current directory. Upstream Fix: https://github.com/madler/pigz/commit/fdad1406b3ec809f4954ff7cdf9e99eb18c2458f References: https://bugs.debian.org/774978 =========================== pax, paxtar: directory traversal vulnerabilities CVE-2015-1193 & CVE-2015-1194 CVE-2015-1193 for the .. path traversal (CWE-22). CVE-2015-1194 for the symlink following, which can allow access outside of the current directory. References: https://bugs.debian.org/774716 http://www.openwall.com/lists/oss-security/2015/01/07/5 CVE distinguishes symlink following from path traversal as different vulnerability types. The fix for one issue is not necessarily guaranteed to fix the other. Also, since symlink following attacks can often be used against protected files within a directory that is already accessible to the attacker, it might cause confusion to use the "directory traversal" term to describe them. 48034 1 sona.sarmadi 2015-01-19 12:37:06 +0000 Additional directory traversal vulnerability via symlinks cpio CVE-2015-1197 Initial report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669 Upstream report: https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html Some discussion: http://www.openwall.com/lists/oss-security/2015/01/07/5 http://www.openwall.com/lists/oss-security/2015/01/08/4 49786 2 liezhi.yang 2015-03-26 08:50:54 +0000 pigz has been upgraded to 2.3.3, so it has been fixed. 50010 3 liezhi.yang 2015-04-01 01:34:42 +0000 pax' problem is minor, and the patch for cpio has been merged.: http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=3837f294227f8d12fd9d954bf1a44dd65b2df1e0