oss-sec mailing list archives
Re: CVE request: uupdate (devscripts) directory traversal
From: cve-assign () mitre org
Date: Fri, 31 Jan 2014 09:17:38 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Package: devscripts
trick uupdate into patching files outside the source package directory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737160
A malicious .orig.tar file
Use CVE-2014-1833. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJS663SAAoJEKllVAevmvmsoqwH/RYO4Vt7CVu16EsoW4lWB5Eb QLkswQy/7qfpL2YU25AAnZMUNK/TCVA/jvIIjaEPalAKCORykmE41RE5xgkIHPhU ZgvaRQMEAA/A/Nab+bDs+zO/wUXtkO+i0BWtNSVz/gzlYRkoNom/7WRUMazmtJwP zLZwpwZAVyfd4fyxYAnRAfrMGLrU3NCk8won7yGNZXZ3ykX+BIZZM3dEFpZH41qv TfbTTFvgzZDEgT+kt6J8AIYTjoG/euJBrOElrV7pPJEInOMZnXvSFU3FaYiPikJY wODTfX34zLklU+IQ5+z++SAPg8DgpUHilrLvmCevxHeeeE8g3K6xNbkdlH6sqzo= =GIZQ -----END PGP SIGNATURE-----
Current thread:
- CVE request: uupdate (devscripts) directory traversal Murray McAllister (Jan 30)
- Re: CVE request: uupdate (devscripts) directory traversal cve-assign (Jan 31)