From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <cygwin-apps-return-35691-listarch-cygwin-apps=sources.redhat.com@cygwin.com>
Received: (qmail 10727 invoked by alias); 18 Feb 2015 02:07:02 -0000
Mailing-List: contact cygwin-apps-help@cygwin.com; run by ezmlm
Precedence: bulk
Sender: cygwin-apps-owner@cygwin.com
List-Id: <cygwin-apps.cygwin.com>
List-Subscribe: <mailto:cygwin-apps-subscribe@cygwin.com>
List-Archive: <http://sourceware.org/ml/cygwin-apps/>
List-Post: <mailto:cygwin-apps@cygwin.com>
List-Help: <mailto:cygwin-apps-help@cygwin.com>, <http://sourceware.org/lists.html#faqs>
Mail-Followup-To: cygwin-apps@cygwin.com
Received: (qmail 10710 invoked by uid 89); 18 Feb 2015 02:07:01 -0000
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-1.6 required=5.0 tests=AWL,BAYES_00,SPF_HELO_PASS autolearn=ham version=3.3.2
X-HELO: mx1.redhat.com
Received: from mx1.redhat.com (HELO mx1.redhat.com) (209.132.183.28) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with (AES256-GCM-SHA384 encrypted) ESMTPS; Wed, 18 Feb 2015 02:07:00 +0000
Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22])	by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t1I26trC030422	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL);	Tue, 17 Feb 2015 21:06:57 -0500
Received: from YAAKOV04.redhat.com ([10.10.116.24])	by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t1I26rNs015899	(version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=NO);	Tue, 17 Feb 2015 21:06:54 -0500
Message-ID: <1424225218.11028.85.camel@cygwin.com>
Subject: [SECURITY] arc
From: Yaakov Selkowitz <yselkowitz@cygwin.com>
To: "cygwin-apps@cygwin.com" <cygwin-apps@cygwin.com>
Cc: Jari Aalto <jari.aalto@cante.net>
Date: Wed, 18 Feb 2015 02:07:00 -0000
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
X-IsSubscribed: yes
X-SW-Source: 2015-02/txt/msg00234.txt.bz2

Jari,

A directory traversal vulnerability has been found in arc.  Please add
the following patches to the arc package ASAP:

http://pkgs.fedoraproject.org/cgit/arc.git/plain/arc-5.21p-hdrv1-read-fix.patch
http://pkgs.fedoraproject.org/cgit/arc.git/plain/arc-5.21p-fix-arcdie.patch
http://pkgs.fedoraproject.org/cgit/arc.git/plain/arc-5.21p-directory-traversel.patch

BTW there are also some documentation patches in that repo which you may
wish to consider adding.

TIA,

Yaakov