Multiple vulnerabilities have been found in unADF that may allow a remote attacker to execute arbitrary code.

Announced

2018-04-22

Revised

2018-04-22

Access

remote

Bugs

#636388

Advisory

https://security.gentoo.org/glsa/201804-20

Affected packages

Package	Arch	Vulnerable	Unaffected
app-arch/unadf	*	< 0.7.12-r1	>= 0.7.12-r1

Background

An unzip like for .ADF files.

Description

Multiple vulnerabilities were discovered in unADF that can lead to remote code execution. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker, by enticing a user to process a specially crafted file, could execute arbitrary code.

Workaround

There is no known workaround at this time.

Resolution

All unADF users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-arch/unadf-0.7.12-r1"

References

• CVE-2016-1243
• CVE-2016-1244