Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
Please login to access the resource
openSUSE:Leap:15.2
perl
perl-archive-tar-dirtrav.diff
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File perl-archive-tar-dirtrav.diff of Package perl
--- ./cpan/Archive-Tar/lib/Archive/Tar.pm.orig 2018-06-27 14:13:08.131148055 +0000 +++ ./cpan/Archive-Tar/lib/Archive/Tar.pm 2018-06-27 14:14:50.562873606 +0000 @@ -842,9 +842,23 @@ sub _extract_file { return; } + ### If a file system already contains a block device with the same name as + ### the being extracted regular file, we would write the file's content + ### to the block device. So remove the existing file (block device) now. + ### If an archive contains multiple same-named entries, the last one + ### should replace the previous ones. So remove the old file now. + ### If the old entry is a symlink to a file outside of the CWD, the new + ### entry would create a file there. This is CVE-2018-12015 + ### <https://rt.cpan.org/Ticket/Display.html?id=125523>. + if (-l $full || -e _) { + if (!unlink $full) { + $self->_error( qq[Could not remove old file '$full': $!] ); + return; + } + } if( length $entry->type && $entry->is_file ) { my $fh = IO::File->new; - $fh->open( '>' . $full ) or ( + $fh->open( $full, '>' ) or ( $self->_error( qq[Could not open file '$full': $!] ), return );
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor