CVE-2016-4007

Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with "illegal options."

Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with "illegal options."

Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with "illegal options."

Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with "illegal options."

This update for obs-service-source_validator to version 0.6+git20160531.fbfe336 fixes one security issue.

This security issue was fixed:

• CVE-2016-4007: harden source services against code/parameter injection (bsc#967265)

This non-security issue was fixed:

• bsc#967610: Several occurrences of uninitialized value

This OBS toolchain update fixes the following issues:

Package 'build':

• CVE-2017-14804: Improve file name check extractbuild (bsc#1069904)
• Fixed Dockerfile repository parsing

Package 'obs-service-source_validator':

• CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec (bnc#938556).
• CVE-2016-4007: Several maintained source services are vulnerable to code/paramter injection (bsc#967265)
• Update to version 0.7.
• Use spec_query instead of output_versions using the specfile parser from the build package (boo#1059858)
• obs-service-source_validator: several occurrences of uninitialized value (bsc#967610)
• hack for util-linux specfiles (bnc#891829)
• fix dependency to gnupg2 for Fedora (bnc#827480)
• exit if tmpdir creation fails (bnc#796918)

Package 'osc':

• Update to version 0.162.0.