-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  cvs security update (SSA:2003-345-01)

CVS is a client/server version control system.  As a server, it
is used to host source code repositories.  As a client, it is
used to access such repositories.  This advisory deals with the
use of CVS as a server.

A security problem which could allow an attacker to create
directories and possibly files outside of the CVS repository has
been fixed with the release of cvs-1.11.10.  Any sites running a
CVS server should upgrade to the new CVS package.


Here are the details from the Slackware 9.1 ChangeLog:
+--------------------------+
Thu Dec 11 12:29:30 PST 2003
patches/packages/cvs-1.11.10-i486-1.tgz:  Upgraded to cvs-1.11.10.
- From the NEWS file:
  SERVER SECURITY ISSUES
    * Malformed module requests could cause the CVS server to attempt to
    create directories and possibly files at the root of the filesystem
    holding the CVS repository.  Filesystem permissions usually prevent
    the creation of these misplaced directories, but nevertheless, the
    CVS server now rejects the malformed requests.
  (* Security fix *)
+--------------------------+


WHERE TO FIND THE NEW PACKAGE:
+-----------------------------+

Updated package for Slackware 8.1:

Updated package for Slackware 9.0:

Updated package for Slackware 9.1:

Updated package for Slackware -current:


MD5 SIGNATURES:
+-------------+

Slackware 8.1 package:
1aff9e868759883f160f7d75800cef63  cvs-1.11.10-i386-1.tgz

Slackware 9.0 package:
fa213d474908fe0cabd9d41270867eb1  cvs-1.11.10-i386-1.tgz

Slackware 9.1 package:
e8b66036e4338e18e8d793c1c2b3e3a3  cvs-1.11.10-i486-1.tgz

Slackware -current package:
422e1586900f6bf1c363c240fc0368b1  cvs-1.11.10-i486-1.tgz


INSTALLATION INSTRUCTIONS:
+------------------------+

First, shut down the cvs server if you are running one.

Then, upgrade the package:
# upgradepkg cvs-1.11.10-i486-1.tgz

Finally, restart the CVS server.


+-----+