{"affected":[{"ecosystem_specific":{"binaries":[{"unrar":"5.6.1-5.3.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","name":"unrar","purl":"pkg:rpm/suse/unrar&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"5.6.1-5.3.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"unrar":"5.6.1-5.3.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","name":"unrar","purl":"pkg:rpm/suse/unrar&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"5.6.1-5.3.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for unrar to version 5.6.1 fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-12938: Prevent remote attackers to bypass a directory-traversal\n  protection mechanism via vectors involving a symlink to the . directory, a\n  symlink to the .. directory, and a regular file (bsc#1054038).\n- CVE-2017-12940: Prevent out-of-bounds read in the EncodeFileName::Decode call\n  within the Archive::ReadHeader15 function (bsc#1054038).\n- CVE-2017-12941: Prevent an out-of-bounds read in the Unpack::Unpack20\n  function (bsc#1054038).\n- CVE-2017-12942: Prevent a buffer overflow in the Unpack::LongLZ function\n  (bsc#1054038).\n\nThese non-security issues were fixed:\n\n- Added extraction support for .LZ archives created by Lzip compressor\n- Enable unpacking of files in ZIP archives compressed with XZ algorithm and\n  encrypted with AES\n- Added support for PAX extended headers inside of TAR archive\n- If RAR recovery volumes (.rev files) are present in the same folder as usual\n  RAR volumes, archive test command verifies .rev contents after completing\n  testing .rar files\n- By default unrar skips symbolic links with absolute paths in link target when\n  extracting unless -ola command line switch is specified\n- Added support for AES-NI CPU instructions \n- Support for a new RAR 5.0 archiving format\n- Wildcard exclusion mask for folders\n- Added libunrar* and libunrar*-devel subpackages (bsc#513804)\n- Prevent conditional jumps depending on uninitialised values (bsc#1046882)\n","id":"SUSE-SU-2018:0862-1","modified":"2018-04-03T15:16:58Z","published":"2018-04-03T15:16:58Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180862-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1046882"},{"type":"REPORT","url":"https://bugzilla.suse.com/1054038"},{"type":"REPORT","url":"https://bugzilla.suse.com/513804"},{"type":"REPORT","url":"https://bugzilla.suse.com/693890"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2012-6706"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-12938"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-12940"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-12941"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-12942"}],"related":["CVE-2012-6706","CVE-2017-12938","CVE-2017-12940","CVE-2017-12941","CVE-2017-12942"],"summary":"Security update for unrar","upstream":["CVE-2012-6706","CVE-2017-12938","CVE-2017-12940","CVE-2017-12941","CVE-2017-12942"]}