Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 837152

Summary: <app-arch/gzip-1.12: Incorrect escaping for filenames in zgrep
Product: Gentoo Security Reporter: Sam James <sam>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: major CC: base-system
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: A2 [glsa+]
Package list:
Runtime testing required: ---
Bug Depends on: 837161    
Bug Blocks: 837143    

Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-04-07 18:05:01 UTC
Fixed in 1.12.
Comment 1 Larry the Git Cow gentoo-dev 2022-04-07 18:11:32 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5a839041a61fbf7f8b54d26c9c9f4d082e8b3561

commit 5a839041a61fbf7f8b54d26c9c9f4d082e8b3561
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-04-07 18:06:15 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-04-07 18:06:15 +0000

    app-arch/gzip: add 1.12
    
    Bug: https://bugs.gentoo.org/837152
    Signed-off-by: Sam James <sam@gentoo.org>

 app-arch/gzip/Manifest         |  2 ++
 app-arch/gzip/gzip-1.12.ebuild | 49 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-04-17 17:15:22 UTC
cleanup done
Comment 3 Larry the Git Cow gentoo-dev 2022-09-07 03:01:32 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=142c539cc4c68c3dc0a3c55f8a7996f7a5b3c3d6

commit 142c539cc4c68c3dc0a3c55f8a7996f7a5b3c3d6
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-09-07 02:51:56 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-09-07 02:58:05 +0000

    [ GLSA 202209-01 ] GNU Gzip, XZ Utils: Arbitrary file write
    
    Bug: https://bugs.gentoo.org/837152
    Bug: https://bugs.gentoo.org/837155
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202209-01.xml | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-09-07 03:19:52 UTC
GLSA released, all done!