Fri Mar 27 16:49:55 2015 UTC ()
SECURITY: Update cabextract to 1.6.

It fixes CVE-2015-2060, a directory traversal vulnerability.
A CAB file with overlong UTF-8 encodings for "/" can get its files extracted to
an absolute path instead of the current directory. [Debian bug #778753]
Under Cygwin, a CAB file using both "/" and "\" can evade checks for absolute
files and "../" directory traversals and can get its files extracted to any
path.


(bsiegert)
diff -r1.26 -r1.27 pkgsrc/archivers/cabextract/Makefile
diff -r1.14 -r1.15 pkgsrc/archivers/cabextract/distinfo
diff -r1.2 -r0 pkgsrc/archivers/cabextract/patches/patch-mspack_system.h
cvs diff -r1.26 -r1.27 pkgsrc/archivers/cabextract/Makefile (expand / switch to unified diff)

--- pkgsrc/archivers/cabextract/Makefile 2015/01/29 13:28:28 1.26
+++ pkgsrc/archivers/cabextract/Makefile 2015/03/27 16:49:55 1.27
@@ -1,15 +1,15 @@ @@ -1,15 +1,15 @@
1# $NetBSD: Makefile,v 1.26 2015/01/29 13:28:28 wiz Exp $ 1# $NetBSD: Makefile,v 1.27 2015/03/27 16:49:55 bsiegert Exp $
2 2
3DISTNAME= cabextract-1.5 3DISTNAME= cabextract-1.6
4CATEGORIES= archivers 4CATEGORIES= archivers
5MASTER_SITES= http://www.cabextract.org.uk/ 5MASTER_SITES= http://www.cabextract.org.uk/
6 6
7MAINTAINER= pkgsrc-users@NetBSD.org 7MAINTAINER= pkgsrc-users@NetBSD.org
8HOMEPAGE= http://www.cabextract.org.uk/ 8HOMEPAGE= http://www.cabextract.org.uk/
9COMMENT= Microsoft cabinet (.CAB) file extractor 9COMMENT= Microsoft cabinet (.CAB) file extractor
10LICENSE= gnu-gpl-v3 10LICENSE= gnu-gpl-v3
11 11
12USE_TOOLS+= gmake 12USE_TOOLS+= gmake
13GNU_CONFIGURE= yes 13GNU_CONFIGURE= yes
14 14
15.include "../../mk/bsd.pkg.mk" 15.include "../../mk/bsd.pkg.mk"
cvs diff -r1.14 -r1.15 pkgsrc/archivers/cabextract/distinfo (expand / switch to unified diff)

--- pkgsrc/archivers/cabextract/distinfo 2015/01/29 13:28:28 1.14
+++ pkgsrc/archivers/cabextract/distinfo 2015/03/27 16:49:55 1.15
@@ -1,6 +1,5 @@ @@ -1,6 +1,5 @@
1$NetBSD: distinfo,v 1.14 2015/01/29 13:28:28 wiz Exp $ 1$NetBSD: distinfo,v 1.15 2015/03/27 16:49:55 bsiegert Exp $
2 2
3SHA1 (cabextract-1.5.tar.gz) = 7ddb31072590a807bef09234f46f940e1ba51067 3SHA1 (cabextract-1.6.tar.gz) = 64f6d5056d3e417a943648c23cb22218b7079ced
4RMD160 (cabextract-1.5.tar.gz) = a1f673aee26b13911eba14fca3b892f8f9cad501 4RMD160 (cabextract-1.6.tar.gz) = 6b693c30aa4d6821b5e83b63a8dc9d58968268b7
5Size (cabextract-1.5.tar.gz) = 241010 bytes 5Size (cabextract-1.6.tar.gz) = 241731 bytes
6SHA1 (patch-mspack_system.h) = e997f6ea664e8fbf7b03ff9fb10fb8adc06d8779 
File Deleted: pkgsrc/archivers/cabextract/patches/Attic/patch-mspack_system.h