[ glsa 201612-15 ] arj

[GLSA]

Gentoo Linux Security Advisory

Title: ARJ: Multiple vulnerabilities (GLSA 201612-15)
Severity: normal
Exploitable: local, remote
Date: December 06, 2016
Bug(s): #535708, #541500
ID: 201612-15

Synopsis

Multiple vulnerabilities have been found in ARJ, the worst of which
may allow attackers to execute arbitrary code.


Background

Open-source implementation of the ARJ archiver.

Affected Packages

Package: app-arch/arj
Vulnerable: < 3.10.22-r5
Unaffected: >= 3.10.22-r5
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in ARJ. Please review the
CVE identifiers referenced below for details.


Impact

An attacker, using a specially crafted ARJ archive, could possibly
execute arbitrary code with the privileges of the process, or cause a
Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All ARJ users should upgrade to the latest version: