Fix released USN-3132-1
** Changed in: tar (Ubuntu)
Status: New => Fix Committed
** Changed in: tar (Ubuntu)
Status: Fix Committed => Fix Released
** Summary changed:
- [needs-packaging] tar : CVE-2016-6321 not patched in stable
+ tar : CVE-2016-6321 not patched in stable
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to tar in Ubuntu.
https://bugs.launchpad.net/bugs/1638922
Title:
tar : CVE-2016-6321 not patched in stable
Status in tar package in Ubuntu:
Fix Released
Bug description:
CVE-2016-6321 path name extract bypass vulnerability is not patched in
stable releases of yakkety, xenial and other supported releases.
The maintainer appears to have only pushed the patch to zesty
proposed.
Please push the patch for the stable releases as this bug could have
seroius implications in certain environments.
Upstream debian has already pushed the patch to stable.
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842339
https://people.canonical.com/~ubuntu-
security/cve/2016/CVE-2016-6321.html
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/tar/+bug/1638922/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
