CVE-2013-0211

Error de signo de enteros en la función archive_write_zip_data de archive_write_set_format_zip.c en la versión 3.1.2 y anteriores, cuando se ejecuta en equipos de 64 bits, permite a atacantes dependientes del contexto causar una denegación del servicio (caída) a través de vectores sin especificar, que desencadena en una conversión incorrecta entre tipos con signo y sin signo, dando lugar a un desbordamiento de búfer.

It was discovered that the libarchive bsdcpio utility extracted absolute paths by default without using the --insecure flag, contrary to expectations. If a user or automated system were tricked into extracting cpio archives containing absolute paths, a remote attacker may be able to write to arbitrary files. Fabian Yamaguchi discovered that libarchive incorrectly handled certain type conversions. A remote attacker could possibly use this issue to cause libarchive to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS. Various other issues were also addressed.