Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sun, 18 Jan 2015 19:16:43 +0300
From: Alexander Cherepanov <>
Subject: Re: CVE request: lhasa: directory traversals

On 2015-01-14 20:33, Henri Salo wrote:
> On Tue, Jan 13, 2015 at 10:44:00PM +0300, Alexander Cherepanov wrote:
> All of these commits are only in versions 0.1.0 and 0.2.0 so no need for
> "incomplete fix for" CVE(s).

Yeah, all of them are between 0.0.7 and 0.1.0. But '..' and symlinks are 
usually seen as different issues.

> Use cases would have be nice.

An example for '..' is easy:

$ touch ../rel
$ jlha a test.lzh ../rel
$ rm ../rel
$ lhasa x test.lzh

But jlha front-end doesn't handle symlinks so you have to use non-free 
lha to archive symlinks. There are some examples in the lhasa repo though:

Alexander Cherepanov

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ