Directory traversal vulnerability

[Felix Geyer]

unrar-nonfree before version 5.2.7 suffers from a symlink directory traversal vulnerability.

More details at:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774171

[Felix Geyer (debfx)]

I'm not aware of any CVE for this issue.

Attached are debdiffs for precise, trusty and utopic.
vivid has 5.2.7, so not affected.

[Steve Beattie (sbeattie)]

Thanks, I'll take a look at these in a bit.

[Launchpad Janitor (janitor)]

This bug was fixed in the package unrar-nonfree - 1:5.0.10-1ubuntu0.14.10.1

---------------
unrar-nonfree (1:5.0.10-1ubuntu0.14.10.1) utopic-security; urgency=medium

  * SECURITY UPDATE: symlink directory traversal vulnerability (LP: #1451260)
    - debian/patches/fix-dir-traversal: backported the upstream fix

 -- Felix Geyer <email address hidden> Sun, 03 May 2015 22:57:02 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package unrar-nonfree - 1:4.0.3-1ubuntu0.1

---------------
unrar-nonfree (1:4.0.3-1ubuntu0.1) precise-security; urgency=medium

  * SECURITY UPDATE: symlink directory traversal vulnerability (LP: #1451260)
    - debian/patches/fix-dir-traversal: backported the upstream fix

 -- Felix Geyer <email address hidden> Sun, 03 May 2015 23:09:30 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package unrar-nonfree - 1:5.0.10-1ubuntu0.14.04.1

---------------
unrar-nonfree (1:5.0.10-1ubuntu0.14.04.1) trusty-security; urgency=medium

  * SECURITY UPDATE: symlink directory traversal vulnerability (LP: #1451260)
    - debian/patches/fix-dir-traversal: backported the upstream fix

 -- Felix Geyer <email address hidden> Sun, 03 May 2015 22:57:02 +0200