oss-security - CVE for SE-2008-06 in PHP 5.2.7 (ZipArchive)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [month] [year] [list]

Date: Thu, 4 Dec 2008 13:43:46 -0800
From: David Remahl <dremahl@...le.com>
To: oss-security@...ts.openwall.com,
 "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE for SE-2008-06 in PHP 5.2.7 (ZipArchive)

http://www.sektioneins.de/advisories/SE-2008-06.txt

PHP 5.2.7 addresses several CVEs that are listed in the NEWS file.  
Apparently, it also addresses the above bug, but no CVE has been  
assigned:

- Fixed extraction of zip files or directories when the entry name is a
   relative path. (Pierre)

The advisory from Stefan also does not contain a CVE.

Steve, please assign

/ Regards, David

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.