[SECURITY] [DSA 4083-1] poco security update

2018-01-1108:51:53

lists.debian.org

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.003

Percentile

68.7%

JSON

Debian Security Advisory DSA-4083-1 [email protected]
https://www.debian.org/security/ Sebastien Delafond
January 11, 2018 https://www.debian.org/security/faq

Package : poco
CVE ID : CVE-2017-1000472

Stephan Zeisberg discovered that poco, a collection of open source C++
class libraries, did not correctly validate file paths in ZIP
archives. An attacker could leverage this flaw to create or overwrite
arbitrary files.

For the oldstable distribution (jessie), this problem has been fixed
in version 1.3.6p1-5+deb8u1.

For the stable distribution (stretch), this problem has been fixed in
version 1.7.6+dfsg1-5+deb9u1.

We recommend that you upgrade your poco packages.

For the detailed security status of poco please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/poco

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian9ppc64ellibpocoxml46< 1.7.6+dfsg1-5+deb9u1libpocoxml46_1.7.6+dfsg1-5+deb9u1_ppc64el.deb
Debian9amd64libpocoxml46< 1.7.6+dfsg1-5+deb9u1libpocoxml46_1.7.6+dfsg1-5+deb9u1_amd64.deb
Debian8armhflibpocoxml9< 1.3.6p1-5+deb8u1libpocoxml9_1.3.6p1-5+deb8u1_armhf.deb
Debian9mipsellibpocoutil46< 1.7.6+dfsg1-5+deb9u1libpocoutil46_1.7.6+dfsg1-5+deb9u1_mipsel.deb
Debian9i386libpocomongodb46< 1.7.6+dfsg1-5+deb9u1libpocomongodb46_1.7.6+dfsg1-5+deb9u1_i386.deb
Debian9ppc64ellibpoconet46-dbgsym< 1.7.6+dfsg1-5+deb9u1libpoconet46-dbgsym_1.7.6+dfsg1-5+deb9u1_ppc64el.deb
Debian9mips64ellibpoconet46< 1.7.6+dfsg1-5+deb9u1libpoconet46_1.7.6+dfsg1-5+deb9u1_mips64el.deb
Debian9arm64libpocoutil46< 1.7.6+dfsg1-5+deb9u1libpocoutil46_1.7.6+dfsg1-5+deb9u1_arm64.deb
Debian9mipslibpococrypto46< 1.7.6+dfsg1-5+deb9u1libpococrypto46_1.7.6+dfsg1-5+deb9u1_mips.deb
Debian7armhflibpococrypto9< 1.3.6p1-4+deb7u1libpococrypto9_1.3.6p1-4+deb7u1_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	ppc64el	libpocoxml46	< 1.7.6+dfsg1-5+deb9u1	libpocoxml46_1.7.6+dfsg1-5+deb9u1_ppc64el.deb
Debian	9	amd64	libpocoxml46	< 1.7.6+dfsg1-5+deb9u1	libpocoxml46_1.7.6+dfsg1-5+deb9u1_amd64.deb
Debian	8	armhf	libpocoxml9	< 1.3.6p1-5+deb8u1	libpocoxml9_1.3.6p1-5+deb8u1_armhf.deb
Debian	9	mipsel	libpocoutil46	< 1.7.6+dfsg1-5+deb9u1	libpocoutil46_1.7.6+dfsg1-5+deb9u1_mipsel.deb
Debian	9	i386	libpocomongodb46	< 1.7.6+dfsg1-5+deb9u1	libpocomongodb46_1.7.6+dfsg1-5+deb9u1_i386.deb
Debian	9	ppc64el	libpoconet46-dbgsym	< 1.7.6+dfsg1-5+deb9u1	libpoconet46-dbgsym_1.7.6+dfsg1-5+deb9u1_ppc64el.deb
Debian	9	mips64el	libpoconet46	< 1.7.6+dfsg1-5+deb9u1	libpoconet46_1.7.6+dfsg1-5+deb9u1_mips64el.deb
Debian	9	arm64	libpocoutil46	< 1.7.6+dfsg1-5+deb9u1	libpocoutil46_1.7.6+dfsg1-5+deb9u1_arm64.deb
Debian	9	mips	libpococrypto46	< 1.7.6+dfsg1-5+deb9u1	libpococrypto46_1.7.6+dfsg1-5+deb9u1_mips.deb
Debian	7	armhf	libpococrypto9	< 1.3.6p1-4+deb7u1	libpococrypto9_1.3.6p1-4+deb7u1_armhf.deb