From 18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7 Mon Sep 17 00:00:00 2001
From: Darshit Shah
Date: Sun, 07 Sep 2014 19:11:17 +0000
Subject: CVE-2014-4877: Arbitrary Symlink Access
Wget was susceptible to a symlink attack which could create arbitrary
files, directories or symbolic links and set their permissions when
retrieving a directory recursively through FTP. This commit changes the
default settings in Wget such that Wget no longer creates local symbolic
links, but rather traverses them and retrieves the pointed-to file in
such a retrieval.
The old behaviour can be attained by passing the --retr-symlinks=no
option to the Wget invokation command.
-- Thorsten Alteholz
ca-certificates (20130119+deb7u1) stable; urgency=low
Update mozilla/certdata.txt to version 1.97
Certificates added (+), removed (-), and renamed (~):
+ "ACCVRAIZ1"
+ "Atos TrustedRoot 2011"
+ "CA Disig Root R1"
+ "CA Disig Root R2"
+ "China Internet Network Information Center EV Certificates Root"
+ "D-TRUST Root Class 3 CA 2 2009"
+ "D-TRUST Root Class 3 CA 2 EV 2009"
+ "E-Tugra Certification Authority"
+ "PSCProcert"
+ "SG TRUST SERVICES RACINE"
+ "StartCom Certification Authority"
~ "StartCom Certification Authority"_2
(both StartCom CAs now included with duplicate CKA_LABEL fix)
+ "Swisscom Root CA 2"
+ "Swisscom Root EV CA 2"
+ "T-TeleSec GlobalRoot Class 2"
+ "TURKTRUST Certificate Services Provider Root 2007"
+ "TWCA Global Root CA"
+ "TeliaSonera Root CA v1"
+ "Verisign Class 3 Public Primary Certification Authority"
~ "Verisign Class 3 Public Primary Certification Authority"_2
(both Verisign Class 3 CAs now included with duplicate CKA_LABEL fix)
- "Equifax Secure eBusiness CA 2"
- "Firmaprofesional Root CA"
- "TC TrustCenter Universal CA III"
- "TDC OCES Root CA"
- "Wells Fargo Root CA"
-- Michael Shuler
Комментариев нет:
Отправить комментарий