Fedora Legacy Test Update Notification: bzip2

[Marc Deslauriers]

---------------------------------------------------------------------
Fedora Legacy Test Update Notification
FEDORALEGACY-2005-158801
Bugzilla https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=158801
2005-10-25
---------------------------------------------------------------------

Name        : bzip2
Versions    : rh73: bzip2-1.0.2-2.2.73.legacy
Versions    : rh9: bzip2-1.0.2-8.1.90.legacy
Versions    : fc1: bzip2-1.0.2-10.1.fc1.legacy
Versions    : fc2: bzip2-1.0.2-12.2.fc2.legacy
Summary     : A file compression utility.
Description :
Bzip2 is a freely available, patent-free, high-quality data compressor
that uses the same command line flags as gzip.

---------------------------------------------------------------------
Update Information:

Updated bzip2 packages that fix multiple issues are now available.

Bzip2 is a data compressor.

A bug was found in the way bzgrep processes file names. If a user can be
tricked into running bzgrep on a file with a carefully crafted file
name, arbitrary commands could be executed as the user running bzgrep.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0758 to this issue.

A bug was found in the way bzip2 modifies file permissions during
decompression. If an attacker has write access to the directory into
which bzip2 is decompressing files, it is possible for them to modify
permissions on files owned by the user running bzip2 (CAN-2005-0953).

A bug was found in the way bzip2 decompresses files. It is possible for
an attacker to create a specially crafted bzip2 file which will cause
bzip2 to cause a denial of service (by filling disk space) if
decompressed by a victim (CAN-2005-1260).

Users of Bzip2 should upgrade to these updated packages, which contain
backported patches to correct these issues.

---------------------------------------------------------------------
Changelogs

rh73:
* Tue Sep 06 2005 David Eisenstein <deisenst at gtw.net> 1.0.2-2.2.73.legacy
- changed the bzgrep patch to match RHEL 3's.  (per bug 158801#c6)
- added tempfile patch so bzdiff/bzcmp creates tempfiles more securely
  (from RHEL 3).  Also added 2/24 & 3/30/05 changelog items.
- added CVE and bugzilla bug numbers to next 4 changelog items.
- renumbered release from "13.1.73.legacy" to "2.2.73.legacy" in keeping
  with FL package versioning scheme.

* Thu Jun 16 2005 Michal Jaegermann <michal at harddata.com>
- resynchronized for rhl7.3 with bzip2-1.0.2-13.FC3.1.src.rpm, #158801

rh9:
* Tue Sep 06 2005 David Eisenstein <deisenst at gtw.net> 1.0.2-8.1.90.legacy
- Recompiled for Red Hat 9.0.  #158801.

fc1:
* Sat Sep 03 2005 David Eisenstein <deisenst at gtw.net> 1.0.2-10.1.fc1.legacy
- Recompiled for Fedora Core 1.  #158801.

fc2:
* Tue Sep 06 2005 David Eisenstein <deisenst at gtw.net> 1.0.2-12.2.fc2.legacy
- Recompiled for Fedora Core 2.  #158801.

---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedoralegacy.org/
(sha1sums)

rh73:
2d0d5267210ceefd6e2ed80187c2f6e3d994e4a0
redhat/7.3/updates-testing/i386/bzip2-1.0.2-2.2.73.legacy.i386.rpm
e661f6bf518498c375918577fc3414978a190d78
redhat/7.3/updates-testing/i386/bzip2-devel-1.0.2-2.2.73.legacy.i386.rpm
0c1bd4a4472ca70183b104438db1a9ef98db4969
redhat/7.3/updates-testing/i386/bzip2-libs-1.0.2-2.2.73.legacy.i386.rpm
f146cb7edfa74345c42831f24cb95c7898db3064
redhat/7.3/updates-testing/SRPMS/bzip2-1.0.2-2.2.73.legacy.src.rpm

rh9:
36b3b8abb700fe93d14064ce22176ed59aef0b9b
redhat/9/updates-testing/i386/bzip2-1.0.2-8.1.90.legacy.i386.rpm
3ce61caa59d4c9a90e2412ebd5bae76500e4e462
redhat/9/updates-testing/i386/bzip2-devel-1.0.2-8.1.90.legacy.i386.rpm
905c29052192f032dac84be0860013837b65f8d4
redhat/9/updates-testing/i386/bzip2-libs-1.0.2-8.1.90.legacy.i386.rpm
bdbf201ea36551c1f5eacff3707656fd5e099c75
redhat/9/updates-testing/SRPMS/bzip2-1.0.2-8.1.90.legacy.src.rpm

fc1:
56b7883ada43718a80577ddcbdbc8bc24072765d
fedora/1/updates-testing/i386/bzip2-1.0.2-10.1.fc1.legacy.i386.rpm
472cee03d32c68e0a0feba56a265c42d208ea5d4
fedora/1/updates-testing/i386/bzip2-devel-1.0.2-10.1.fc1.legacy.i386.rpm
94abc962a1b84373813c558d4d3d44993722bb16
fedora/1/updates-testing/i386/bzip2-libs-1.0.2-10.1.fc1.legacy.i386.rpm
7ce97f2488338b9d0e4b136b63c04e80c7a27394
fedora/1/updates-testing/SRPMS/bzip2-1.0.2-10.1.fc1.legacy.src.rpm

fc2:
c2821d2326bdff302a8b38ab6baec2930da4ca6b
fedora/2/updates-testing/i386/bzip2-1.0.2-12.2.fc2.legacy.i386.rpm
d1ba1f61d62970f0d97af8813956771b471fbc81
fedora/2/updates-testing/i386/bzip2-devel-1.0.2-12.2.fc2.legacy.i386.rpm
c8cf989f3683f4313d4a0caf7695673f48e405e7
fedora/2/updates-testing/i386/bzip2-libs-1.0.2-12.2.fc2.legacy.i386.rpm
1ac418e19c22613a3cc4d71ee304a9d304af50e6
fedora/2/updates-testing/SRPMS/bzip2-1.0.2-12.2.fc2.legacy.src.rpm

---------------------------------------------------------------------

Please test and comment in bugzilla.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/fedora-legacy-list/attachments/20051025/cca635c6/attachment.sig>