Security update for pigz SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0670-1 Final 1 1 2015-03-24T17:18:12Z current 2015-03-24T17:18:12Z 2015-03-24T17:18:12Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for pigz Pigz, a multi-threaded implementation of gzip, was updated to fix one vulnerability. The following vulnerability was fixed: * A crafted file could have caused an unwanted directory traversal on extract (CVE-2015-1191) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-156,SUSE-SLE-SERVER-12-2015-156 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150670-1/ Link for SUSE-SU-2015:0670-1 https://lists.suse.com/pipermail/sle-security-updates/2015-April/001331.html E-Mail link for SUSE-SU-2015:0670-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/913627 SUSE Bug 913627 https://www.suse.com/security/cve/CVE-2015-1191/ SUSE CVE CVE-2015-1191 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 pigz-2.3-5.1 pigz-2.3-5.1 as a component of SUSE Linux Enterprise Desktop 12 pigz-2.3-5.1 as a component of SUSE Linux Enterprise Server 12 pigz-2.3-5.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive. CVE-2015-1191 SUSE Linux Enterprise Desktop 12:pigz-2.3-5.1 SUSE Linux Enterprise Server 12:pigz-2.3-5.1 SUSE Linux Enterprise Server for SAP Applications 12:pigz-2.3-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150670-1/ https://www.suse.com/security/cve/CVE-2015-1191.html CVE-2015-1191 https://bugzilla.suse.com/913627 SUSE Bug 913627