From 7564f1de067e9e3cf0aa2662cab79b9834b54ff1 Mon Sep 17 00:00:00 2001 From: Fabrice Fontaine Date: Sat, 21 May 2022 14:40:33 +0200 Subject: [PATCH] package/unrar: security bump to version 6.1.7 Fix CVE-2022-30333: RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. 6.12 application version corresponds to 6.1.7 source version: https://github.com/debian-calibre/unrar-nonfree/compare/upstream/6.1.6...upstream/6.1.7 Signed-off-by: Fabrice Fontaine Signed-off-by: Thomas Petazzoni --- package/unrar/unrar.hash | 2 +- package/unrar/unrar.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/unrar/unrar.hash b/package/unrar/unrar.hash index e354753bb2..40e05a1a32 100644 --- a/package/unrar/unrar.hash +++ b/package/unrar/unrar.hash @@ -1,3 +1,3 @@ # Locally computed: -sha256 d05022442009202a792e588bec58921c123ff046fc755f7f2272871a5bd79636 unrarsrc-6.1.3.tar.gz +sha256 de75b6136958173fdfc530d38a0145b72342cf0d3842bf7bb120d336602d88ed unrarsrc-6.1.7.tar.gz sha256 6ecc1687808b7d66b24f874755abfed7464d9751ed0001cd4e8e5d9bf397ff8a license.txt diff --git a/package/unrar/unrar.mk b/package/unrar/unrar.mk index 6923660153..fee9fb753b 100644 --- a/package/unrar/unrar.mk +++ b/package/unrar/unrar.mk @@ -4,7 +4,7 @@ # ################################################################################ -UNRAR_VERSION = 6.1.3 +UNRAR_VERSION = 6.1.7 UNRAR_SOURCE = unrarsrc-$(UNRAR_VERSION).tar.gz UNRAR_SITE = https://www.rarlab.com/rar UNRAR_LICENSE = unrar