---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2004-295
2004-09-08
---------------------------------------------------------------------

Product     : Fedora Core 2
Name        : lha
Version     : 1.14i
Release     : 14.1
Summary     : An archiving and compression utility for LHarc format 
archives.
Description :
LHA is an archiving and compression utility for LHarc format archives.
LHA is mostly used in the DOS world, but can be used under Linux to
extract DOS files from LHA archives.

Install the lha package if you need to extract DOS files from LHA archives.

---------------------------------------------------------------------
Update Information:

Lukasz Wojtow discovered a stack-based buffer overflow in all versions
of lha up to and including version 1.14. A carefully created archive could
allow an attacker to execute arbitrary code when a victim extracts or tests
the archive. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0769 to this issue.

Buffer overflows were discovered in the command line processing of all
versions of lha up to and including version 1.14. If a malicious user can
trick a victim into passing a specially crafted command line to the lha
command, it is possible that arbitrary code could be executed. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
names CAN-2004-0771 and CAN-2004-0694 to these issues.

Thomas Biege discovered a shell meta character command execution
vulnerability in all versions of lha up to and including 1.14. An attacker
could create a directory with shell meta characters in its name which could
lead to arbitrary command execution. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0745 to
this issue.

Users of lha should update to this updated package
---------------------------------------------------------------------
* Tue Sep 07 2004 Than Ngo <than@redhat.com> 1.14i-14.1

- security vulnerabilities CAN-2004-0769, CAN-2004-0771, CAN-2004-0694, 
CAN-2004-0745


---------------------------------------------------------------------
This update can be downloaded from:
 http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/

bccb95c64b01e506961bdacb3323031b  SRPMS/lha-1.14i-14.1.src.rpm
af515d31f9ff998a88383d0651efff68  x86_64/lha-1.14i-14.1.x86_64.rpm
8641060ad39c6bbe14e68014fbe06ce2  
x86_64/debug/lha-debuginfo-1.14i-14.1.x86_64.rpm
494c07eccce7cd3f5a040d8fb384eb8b  i386/lha-1.14i-14.1.i386.rpm
a8d018efd6c9fe0b8db6f96327557182  
i386/debug/lha-debuginfo-1.14i-14.1.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.
---------------------------------------------------------------------


--
fedora-announce-list mailing list
fedora-announce-list@redhat.com
http://www.redhat.com/mailman/listinfo/fedora-announce-list