DSA-017-1 jazip -- buffer overflow

Debian Security Advisory

DSA-017-1 jazip -- buffer overflow

Date Reported:

23 Jan 2001

Affected Packages:

jazip

Vulnerable:

Yes

Security database references:

In the Bugtraq database (at SecurityFocus): BugTraq ID 2209.
In Mitre's CVE dictionary: CVE-2001-0110.

More information:

With older versions of jazip a user could gain root access for members of the floppy group to the local machine. The interface doesn't run as root anymore and this very exploit was prevented. The program now also truncates DISPLAY to 256 characters if it is bigger, which closes the buffer overflow (within xforms).

We recommend you upgrade your jazip package immediately.

Fixed in:

Debian 2.2 (potato)

Source:

http://security.debian.org/dists/stable/updates/main/source/jazip_0.33-1.dsc

http://security.debian.org/dists/stable/updates/main/source/jazip_0.33-1.diff.gz

http://security.debian.org/dists/stable/updates/main/source/jazip_0.33.orig.tar.gz

alpha:

http://security.debian.org/dists/stable/updates/main/binary-alpha/jazip_0.33-1_alpha.deb

arm:

http://security.debian.org/dists/stable/updates/main/binary-arm/jazip_0.33-1_arm.deb

i386:

http://security.debian.org/dists/stable/updates/main/binary-i386/jazip_0.33-1_i386.deb

m68k:

http://security.debian.org/dists/stable/updates/main/binary-m68k/jazip_0.33-1_m68k.deb

powerpc:

http://security.debian.org/dists/stable/updates/main/binary-powerpc/jazip_0.33-1_powerpc.deb

sparc:

http://security.debian.org/dists/stable/updates/main/binary-sparc/jazip_0.33-1_sparc.deb