Bug 780858 – <app-arch/file-roller-3.38.1: arbitrary file overwrite via malicious archive

• Status: IN_PROGRESS
• Product: Gentoo Security

[Description John Helmert III 2021-04-07 14:58:28 UTC]

More details at $URL, seems there's unreleased patches for each branch:

https://gitlab.gnome.org/GNOME/file-roller/-/commit/4aaa7c65140762d5cf0df335a7bb795f242d18a8
https://gitlab.gnome.org/GNOME/file-roller/-/commit/0bd4a14f3bc8dae7c68469f281da9fddbe9e0d02

[Comment 1 Larry the Git Cow 2021-04-12 21:59:48 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7fa2274b5f6971f85a360c8d7584879a02e9d0ff

commit 7fa2274b5f6971f85a360c8d7584879a02e9d0ff
Author:     Matt Turner <[e-mail]>
AuthorDate: 2021-04-12 20:47:48 +0000
Commit:     Matt Turner <[e-mail]>
CommitDate: 2021-04-12 21:59:21 +0000

    app-arch/file-roller: Version bump to 3.38.1
    
    Bug: https://bugs.gentoo.org/780858
    Signed-off-by: Matt Turner <[e-mail]>

 app-arch/file-roller/Manifest                  |  1 +
 app-arch/file-roller/file-roller-3.38.1.ebuild | 91 ++++++++++++++++++++++++++
 2 files changed, 92 insertions(+)

[Comment 2 Sam James 2021-04-12 22:03:34 UTC]

Thanks Matt! Let us know when ready to stable.

[Comment 3 Sam James 2021-04-21 18:51:58 UTC]

amd64 done

[Comment 4 Sam James 2021-04-25 17:40:18 UTC]

x86 done

all arches done

[Comment 5 John Helmert III 2021-04-25 23:59:11 UTC]

Please cleanup

[Comment 6 Larry the Git Cow 2021-04-28 16:30:28 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d04dcd02e4709461dcbc50b5ebb1c073a0421268

commit d04dcd02e4709461dcbc50b5ebb1c073a0421268
Author:     Matt Turner <[e-mail]>
AuthorDate: 2021-04-28 16:30:07 +0000
Commit:     Matt Turner <[e-mail]>
CommitDate: 2021-04-28 16:30:11 +0000

    app-arch/file-roller: Drop old versions
    
    Bug: https://bugs.gentoo.org/780858
    Signed-off-by: Matt Turner <[e-mail]>

 app-arch/file-roller/Manifest                  |  1 -
 app-arch/file-roller/file-roller-3.38.0.ebuild | 91 --------------------------
 2 files changed, 92 deletions(-)

[addCollapseLink(7, 1, 'Toggle comment display'); Comment 7 NATTkA bot 2021-05-31 02:00:27 UTC Comment hidden (obsolete)]

Unable to check for sanity:

> no match for package: app-arch/file-roller-3.38.1

[addCollapseLink(8, 1, 'Toggle comment display'); Comment 8 NATTkA bot 2021-07-29 17:23:12 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(9, 1, 'Toggle comment display'); Comment 9 NATTkA bot 2021-07-29 17:31:32 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(10, 1, 'Toggle comment display'); Comment 10 NATTkA bot 2021-07-29 17:39:29 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(11, 1, 'Toggle comment display'); Comment 11 NATTkA bot 2021-07-29 17:47:40 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(12, 1, 'Toggle comment display'); Comment 12 NATTkA bot 2021-07-29 18:03:36 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[Comment 13 NATTkA bot 2021-07-29 18:11:54 UTC]

Package list is empty or all packages have requested keywords.