lha: LHa Multiple Vulnerabilities

Debian Bug report logs - #401301
lha: LHa Multiple Vulnerabilities

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@sfritsch.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: lha: LHa Multiple Vulnerabilities

Date: Sat, 02 Dec 2006 13:54:57 +0100

Package: lha
Version: 1.14i-10
Severity: grave
Tags: security
Justification: user security hole


LHA seems to be affected by 
CVE-2006-4335
CVE-2006-4337
CVE-2006-4338

See 
http://secunia.com/advisories/23153/
for details

Message #10 received at 401301@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Stefan Fritsch <sf@sfritsch.de>

Cc: 401301@bugs.debian.org

Subject: Re: lha: LHa Multiple Vulnerabilities

Date: Tue, 5 Dec 2006 23:48:25 +0100

On Sat, Dec 02, 2006 at 01:54:57PM +0100, Stefan Fritsch wrote:
> Package: lha
> Version: 1.14i-10
> Severity: grave
> Tags: security
> Justification: user security hole
> 
> 
> LHA seems to be affected by 
> CVE-2006-4335
> CVE-2006-4337
> CVE-2006-4338

If GNU gzip can handle LHA archives I'm wondering if the non-free
lha is really worth keeping?

Cheers,
        Moritz

Message #15 received at 401301@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@sfritsch.de>

To: Moritz Muehlenhoff <jmm@inutil.org>

Cc: 401301@bugs.debian.org

Subject: Re: lha: LHa Multiple Vulnerabilities

Date: Wed, 6 Dec 2006 09:28:28 +0100

On Tuesday 05 December 2006 23:48, Moritz Muehlenhoff wrote:
> If GNU gzip can handle LHA archives I'm wondering if the non-free
> lha is really worth keeping?

I don't think gzip can handle LHA archives. It just supports one 
obscure format that uses LHA's algorithm.

BTW, in combination with amavisd-new and possibliy with clamav, this 
issue may allow remote code execution. At least amavisd-new uses lha 
by default when it is installed.

Stefan

Message #20 received at 401301@bugs.debian.org (full text, mbox, reply):

From: Andreas Barth <aba@not.so.argh.org>

To: Stefan Fritsch <sf@sfritsch.de>

Cc: Debian Bug Tracking System <401301@bugs.debian.org>

Subject: Re: lha: LHa Multiple Vulnerabilities

Date: Sat, 9 Dec 2006 21:38:01 +0100

* Stefan Fritsch (sf@sfritsch.de) [061202 04:55]:
> LHA seems to be affected by 
> CVE-2006-4335
> CVE-2006-4337
> CVE-2006-4338

All these bugs seem to be in gzip, not in lha?


Cheers,
Andi
-- 
  http://home.arcor.de/andreas-barth/

Message #25 received at 401301-done@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: 401301-done@bugs.debian.org

Subject: Fixed

Date: Wed, 13 Dec 2006 23:35:27 +0100

Version: 1.14i-10.1

Message #30 received at 401301@bugs.debian.org (full text, mbox, reply):

From: GOTO Masanori <gotom@debian.org>

To: Moritz Muehlenhoff <jmm@inutil.org>, gotom@debian.org, 401301@bugs.debian.org

Subject: Re: Bug#401301: marked as done (lha: LHa Multiple Vulnerabilities)

Date: Sat, 23 Dec 2006 09:09:28 +0900

At Wed, 13 Dec 2006 15:03:26 -0800,
Debian Bug Tracking System wrote:
> To: 401301-done@bugs.debian.org
> Subject: Fixed
> From: Moritz Muehlenhoff <jmm@inutil.org>
> Date: Wed, 13 Dec 2006 23:35:27 +0100
> Message-ID: <20061213223527.GA3405@galadriel.inutil.org>
> 
> Version: 1.14i-10.1

Thanks for your help!  I'll check the patch.

Regards,
-- gotom

Send a report that this bug log contains spam.