Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.1045 sharutils security update 6 April 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: sharutils Publisher: Debian Operating System: Debian GNU/Linux 8 Debian GNU/Linux 9 Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction Denial of Service -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2018-1000097 Reference: ESB-2018.0832 Original Bulletin: http://www.debian.org/security/2018/dsa-4167 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - - ------------------------------------------------------------------------- Debian Security Advisory DSA-4167-1 security@debian.org https://www.debian.org/security/ Luciano Bello April 05, 2018 https://www.debian.org/security/faq - - ------------------------------------------------------------------------- Package : sharutils CVE ID : CVE-2018-1000097 Debian Bug : 893525 A buffer-overflow vulnerability was discovered in Sharutils, a set of utilities handle Shell Archives. An attacker with control on the input of the unshar command, could crash the application or execute arbitrary code in the its context. For the oldstable distribution (jessie), this problem has been fixed in version 4.14-2+deb8u1. For the stable distribution (stretch), this problem has been fixed in version 1:4.15.2-2+deb9u1. We recommend that you upgrade your sharutils packages. For the detailed security status of sharutils please refer to its security tracker page at: https://security-tracker.debian.org/tracker/sharutils Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org - -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEayzFlnvRveqeWJspbsLe9o/+N3QFAlrGU8EACgkQbsLe9o/+ N3SX9Q/6A6qLYBDrTSnlqUqjWKiQXTUGMGndookV24BCpSapSXYtFjPph6N5WVny 55vq3Ume6rZuSix8D4+WWktZTPKS2iDgVtCZWRG7Onl0WJGgkXUETrd31/hvT8PJ izGyhzlbDaQtjerZxIMXzqtjlMyUmN0cDyhRd6JxT6Uu2FMCUqkCZenfxxSbo2W9 N322K98cU20C3WO/1KnMWpVMSEEaBTnW612gcfN59eR10pilQK/Pst2PCfEaf83K 6LVI07HHIHxe3sS2WJB2CMkClYCNB9Xzcp+PyHcn9oFhmwPNFo3jix3/0ueG/Agt YOshVmk/wsRN+Kqx+b8R9/i+aZaNQV2sr9Ml0C+nHREBWxE5wykSe+F25b7Gq3AD XabbQmQouEDFtIkNQ8tVBhnhLh3HxWD35l2WQV98A1XYPCllwVqrBj7c9d2DaQDF 63zin1gCivzUtaQWmNjOTA2ATbKfDZHgqFfMvcBuIbCCykHYctHKJiEXC/5LeoI+ d61iRxytLy+l5oDDsaRi9KWFabDmgb+65asvEHwgz2nbtcxMfilanYuO7aS5ET9+ ZcEFTmhUqMb8Ly8Ln4ikLNeAtcR4MrrTXm+ZIWkzhF2eLWKuRswVL6ZdkAAls8/W fwi0b13695gwpsleoGuNOJCLQwiCOm8xmzbnNaua3LQLZmBGWmg= =dr+o - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWsbGEYx+lLeg9Ub1AQiZKhAAj2csWtJUxsBwWEgmcTG+Rp859YjoX9wu 8FYow0Cd/JwQLGPizwMlRQcHI8LZqPS2GflK4WGoDD0hzmi3r303YTUS62z9/ZwY dhVRWC8F1baV6IJxre9Iaj3pfu2IeZwjUwKWT1lm8GH2I5CL03uLBc1LyjB9SW80 rRIQphSqh14n/SvT75zcPxChdyIbkHsubYyzCvqRQy8bJMlGA6Dga9F2A6EC9vYM Q65kyhXxFebPCuh1hqd5r2cTaWZADaNOjmhveGRnA8bSrXTxZLTANHkQQvM4s1fu y20Rel/a3cyxXoQtTYekvIWruRnDx5g62k/1/7AXElqxFCg4LWLB9h4khEZz2Gvl zXQq26W6meI2BJcjNtH7gDh66mZDHqjDHtHgH0kzusq31UPLFxYz4PxHopRKr4UC Y4cjG9hxYMpuzIr+e7+EGB0bjp7/R1u89IrhscXyspBuvObTyv8OH4KYIWwVxm/r 2sktthu9p5H4/7riGI97qBlPfrveSSyRrA35OyZ3ZZ69JzDJMhiYW8jmZoRCKHB8 2OxGL5ekVXWQrsfVJszHsDAhxeoHyKeq2xFuIwFQLijNWv4+XOuKQPFWQzF8WpZP +AyNxG7fdMzaA0uHvoR7Xf0vHlUeSL2hYg8vJZaDygmKlXtatYXl7rti5tnu/oJL AcC+kewtjU8= =l7Xn -----END PGP SIGNATURE-----