Public bug reported: Binary package hint: atool
Quoth the atool changelog at http://www.nongnu.org/atool/news.html: > ATTENTION: This release fixes a serious bug which might cause files and > directories to be removed in some circumstances when using adiff. I > recommend upgrading to the 0.31.0 immediately. If you cannot upgrade, you > are safe as long as you do not use the adiff command on untrusted archives. > Here are the details: Symbolic links would be followed when temporary > directories were removed recursively. Only the adiff command removed > directories in this way - the extracted files of the archives it compared. > This means that if you ran adiff on an archive containing a symbolic link > that pointed to, say, /foo, /foo would be removed recursively! This was due > to a missing check for symbolic links. This bug was found by code auditing, > and has been fixed in this release. The version of atool currently in Ubuntu is 0.29.0. ** Affects: atool (Ubuntu) Importance: Undecided Status: Unconfirmed -- Current version may cause files to be deleted inadvertently https://launchpad.net/bugs/94239 -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
