Summary: | dev-lang/perl: Directory traversal in Archive::Tar (CVE-2018-12015) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | GLSAMaker/CVETool Bot <glsamaker> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | minor | CC: | bugs, nobrowser, perl |
Priority: | Normal | Flags: | stable-bot:
sanity-check+
|
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | B3 [cve noglsa] | ||
Package list: |
virtual/perl-Archive-Tar-2.300.0-r1
perl-core/Archive-Tar-2.300.0
|
Runtime testing required: | --- |
Description
GLSAMaker/CVETool Bot
2018-06-12 11:18:08 UTC
*** Bug 657778 has been marked as a duplicate of this bug. *** The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=99fda8ae7b10c15df793d4080339f59ea169acd8 commit 99fda8ae7b10c15df793d4080339f59ea169acd8 Author: Kent Fredric <kentnl@gentoo.org> AuthorDate: 2018-07-06 01:44:07 +0000 Commit: Kent Fredric <kentnl@gentoo.org> CommitDate: 2018-07-06 01:44:32 +0000 dev-lang/perl: Bump 5.28.9999 to 5.28.0 Final - Still fails tests due to bug #645084 Upstream: - Now includes Archive-Tar 2.280.0 for CVE-2018-12015 (Bug #657968) Bug: https://bugs.gentoo.org/645084 Bug: https://bugs.gentoo.org/657968 Package-Manager: Portage-2.3.40, Repoman-2.3.9 dev-lang/perl/Manifest | 2 +- dev-lang/perl/perl-5.28.9999.ebuild | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b847f7f94bcfc09435a9cf08c00d842d09171f22 commit b847f7f94bcfc09435a9cf08c00d842d09171f22 Author: Kent Fredric <kentnl@gentoo.org> AuthorDate: 2018-07-06 05:59:21 +0000 Commit: Kent Fredric <kentnl@gentoo.org> CommitDate: 2018-07-06 05:59:38 +0000 virtual/perl-Archive-Tar: Bump to 2.300.0 for CVE-2018-12015 bug #657968 This pulls perl-core/Archive-Tar for everyone currently on ~arch, and will likely be stabilized before/with dev-lang/perl-5.26.2 Bug: https://bugs.gentoo.org/657968 Package-Manager: Portage-2.3.40, Repoman-2.3.9 virtual/perl-Archive-Tar/perl-Archive-Tar-2.300.0.ebuild | 15 +++++++++++++++ 1 file changed, 15 insertions(+) This somehow was missed. All arches, please stabilize virtual/perl-Archive-Tar-2.300.0-r1 perl-core/Archive-Tar-2.300.0 amd64 stable s390 stable x86 stable alpha stable hppa stable arm64 stable arm stable sparc stable ia64 stable ppc64 stable ppc stable All security-supported arches done. @security please proceed GLSA Vote: No! Repository is clean, all done! |