DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:reply-to:mime-version:from:date:message-id
	:subject:to:content-type; q=dns; s=default; b=Aqb0ZlzJXQPCf8QjQT
	DyQQPUkw9avLcMwfsuoUjoheFhf4oTa15Hg1OP2JC3wSLK9QIGJrxhjEdMam4b50
	f+eIffz4ByFcAqOc3i2mBOi7q+duCJMCzMQG5kvUgv1TSYrYkdj4EZITM3ZNfzNn
	etT66KZgSyErQGSMqr/X0sr1o=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Reply-To: cygwin AT cygwin DOT com
MIME-Version: 1.0
From: Kyzer <stuart DOT caie AT gmail DOT com>
Date: Wed, 25 Mar 2015 22:49:04 +0000
Message-Id: <announce.CAOCY71Dh=N_v9iQxs==UsZBq+mTiojnesx_Gp+PspQcxdJnk1A@mail.gmail.com>
Subject: [ANNOUNCEMENT] Updated: cabextract-1.6-1
To: cygwin AT cygwin DOT com
Content-Type: text/plain; charset=ISO-8859-1

Version1.6-1 of "cabextract" has been uploaded.

cabextract is a utility for extracting Microsoft Cabinet (.CAB) files

This update fixes a number of security bugs:

* CVE-2014-9556: A CAB file with invalid file offset or length (where
offset + length == 2^32) causes an infinite loop in the Quantum
decoder on 32-bit architectures. [Debian bugs #772891, #773041]
* CVE-2015-2060: A CAB file with overlong UTF-8 encodings for "/" can
get its files extracted to an absolute path instead of the current
directory. [Debian bug #778753]
* On Cygwin, a CAB file using both "/" and "\" can evade checks for
absolute files and "../" directory traversals and can get its files
extracted to any path.
* A CAB file with two folders, the second folder invalid, and a file
decompression order of folder 1, 2, 1, causes execution to jump to
NULL. [Debian bugs #773659, #774665]
* A CAB file with MSZIP-compressed data and a distance code of 30
causes a 1 byte over-read [Debian bug #775498]
* A CAB file with zero-length filenames causes a 1 byte over-read.
* A CAB file with invalid UTF-8 encoded filenames causes over-read of
up to 5 bytes.
* A CAB file with LZX-compressed data ending early during an odd-sized
uncompressed block can cause a 1-byte under-read. [Debian bug #775499]

              *** CYGWIN-ANNOUNCE UNSUBSCRIBE INFO ***

If you want to unsubscribe from the cygwin-announce mailing list, look
at the "List-Unsubscribe: " tag in the email header of this message.
Send email to the address specified there. It will be in the format:

cygwin-announce-unsubscribe-you=yourdomain.com <at> cygwin.com

If you need more information on unsubscribing, start reading here:

http://sourceware.org/lists.html#unsubscribe-simple

Please read *all* of the information on unsubscribing that is
available starting at this URL.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple