MGASA-2019-0396 - Updated flightcrew packages fix security vulnerabilities

Publication date: 19 Dec 2019
URL: https://advisories.mageia.org/MGASA-2019-0396.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2019-13032,
     CVE-2019-13241

The updated packages fix security vulnerabilities:

An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL
pointer dereference occurs in GetRelativePathToNcx() or
GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to
xc::XMLUri::isValidURI(). This affects third-party software (not Sigil)
that uses FlightCrew as a library. (CVE-2019-13032)

FlightCrew v0.9.2 and older are vulnerable to a directory traversal,
allowing attackers to write arbitrary files via a ../ (dot dot slash)
in a ZIP archive entry that is mishandled during extraction.
(CVE-2019-13241)

References:
- https://bugs.mageia.org/show_bug.cgi?id=25281
- https://ubuntu.com/security/notices/USN-4055-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13032
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13241

SRPMS:
- 7/core/flightcrew-0.9.0-10.1.mga7