Bug#879732: CVE-2017-15874 / CVE-2017-15873

2017-10-25 Thread Moritz Muehlenhoff
On Wed, Oct 25, 2017 at 07:27:42PM +0200, Christoph Biedl wrote: > Tags: upstream confirmed > > Moritz Muehlenhoff wrote... > > > Hi, > > please see: > > Thanks for the heads-up, we'll try to get this fixed as soon as > possible. For the moment, I'm somewhat confused about the affected > distrib

Bug#879732: CVE-2017-15874 / CVE-2017-15873

2017-10-25 Thread Christoph Biedl
Tags: upstream confirmed Moritz Muehlenhoff wrote... > Hi, > please see: Thanks for the heads-up, we'll try to get this fixed as soon as possible. For the moment, I'm somewhat confused about the affected distributions as listed in the security tracker. Could you please check? > CVE-2017-15873 >

Bug#879732: CVE-2017-15874 / CVE-2017-15873

2017-10-25 Thread Moritz Muehlenhoff
Package: busybox Version: 1:1.27.2-1 Severity: important Tags: security Hi, please see: CVE-2017-15873 The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation. https://bugs.busybox.net/show_bug.cg