Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20150831142942.74f0a4b7@pc1>
Date: Mon, 31 Aug 2015 14:29:42 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: Out of bounds read using malformed tar archive
 in GNU Tar and BSD Tar

On Mon, 31 Aug 2015 08:20:11 -0300
Gustavo Grieco <gustavo.grieco@...il.com> wrote:

> Fortunately the last revisions of GNU Tar and libarchive fixed these
> issues. Do we have CVE for these issues?

The bsdtar issue looks like this one:
https://github.com/libarchive/libarchive/issues/515

I have reported ~20 such issues in libarchive in the past months.
Unfortunately there are still some open issues, I was hoping to create
an advisory once everything is done, but it has taken much longer than
expected.

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno@...eck.de
GPG: BBB51E42

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.