ASA-201702-14 log generated external raw
[ASA-201702-14] diffoscope: arbitrary file overwrite |
---|
Arch Linux Security Advisory ASA-201702-14
==========================================
Severity: Medium
Date : 2017-02-17
CVE-ID : CVE-2017-0359
Package : diffoscope
Type : arbitrary file overwrite
Remote : No
Link : https://security.archlinux.org/AVG-175
Summary
=======
The package diffoscope before version 77-1 is vulnerable to arbitrary
file overwrite.
Resolution
==========
Upgrade to 77-1.
# pacman -Syu "diffoscope>=77-1"
The problem has been fixed upstream in version 77.
Workaround
==========
None.
Description
===========
It has been discovered that diffoscope may write to arbitrary locations
on disk depending on the contents of an untrusted archive.
Impact
======
An attacker is able to create a specially crafted archive that, when
processed, overwrites arbitrary files on disc.
References
==========
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723
https://anonscm.debian.org/git/reproducible/diffoscope.git/commit/?id=632a40828a54b399787c25e7fa243f732aef7e05
https://security.archlinux.org/CVE-2017-0359
|