[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[FD] [CSS] POINTYFEATHER / tar extract pathname bypass (CVE-2016-6321) - patch update
Update on the advisory: As pointed out by several people, the ERROR
macro did't fail the operation in a desired way: Files were still
being created by tar. In order to really stop tar from doing silly
things, FATAL_ERROR macro needs to be used instead.
The patch has now been updated accordingly.
NOTE: Ideas on how to make tar safely skip such entries instead of
failing the whole operating are welcome.
Sent through the Full Disclosure mailing list
Web Archives & RSS: http://seclists.org/fulldisclosure/