new upstream release 1.05 with security fix

[André Klitzing]

Binary package hint: bzip2

The current version is 1.0.5, released 17 March 2008.

Version 1.0.5 removes a potential security vulnerability (CERT-FI 20469 as it applies to bzip2) in versions 1.0.4 and earlier, so all users are recommended to upgrade immediately.

https://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html

CHANGES:
1.0.5 (10 Dec 07)
~~~~~~~~~~~~~~~~~
Security fix only. Fixes CERT-FI 20469 as it applies to bzip2.

[hanno (hanno-gentoo-bugs)]

CERT-FI did a fuzzing tool test and discovered issues in various archiving tools.

bzip2 is vulnerable, fixed in 1.0.5. This code is probably bundled in some other packages.

[vapier (vapier-gentoo-bugs)]

ive added 1.0.5 to the tree ... now if only they didnt screw up the packaging of it ...

[rbu (rbu-gentoo-bugs)]

Arches, please test and mark stable:
=app-arch/bzip2-1.0.5
Target keywords : "alpha amd64 arm hppa ia64 m68k mips ppc ppc64 release s390 sh sparc x86"

[rbu (rbu-gentoo-bugs)]

Created attachment 146488
bzip2-CERT-FI-20469.patch

Just for reference, the patch.

[fmccor (fmccor-gentoo-bugs)]

Sparc stable. All tests pass, it works on my files, and portage can use it.

[jer (jer-gentoo-bugs)]

(In reply to comment #4)
> Sparc stable. All tests pass, it works on my files, and portage can use it.

That's odd. Ferris forgot to mark the ebuild. So er, stable for HPPA and SPARC then. :)

[dertobi123 (dertobi123-gentoo-bugs)]

ppc stable

[armin76 (armin76-gentoo-bugs)]

alpha/ia64/x86 stable

[beandog (beandog-gentoo-bugs)]

amd64 stable

[rhill (rhill-gentoo-bugs)]

there's no need to cc mips on security stabilization bugs. we're ~arch only.

[corsair (corsair-gentoo-bugs)]

ppc64 stable

[Kees Cook (kees)]

CVE-2008-1372

[pva (pva-gentoo-bugs)]

Fixed in release snapshot.

[rbu (rbu-gentoo-bugs)]

request filed

[Kees Cook (kees)]

This has been released as: http://www.ubuntu.com/usn/usn-590-1

[py (py-gentoo-bugs)]

GLSA 200804-02