Arch Linux Security Advisory ASA-201702-14 ========================================== Severity: Medium Date : 2017-02-17 CVE-ID : CVE-2017-0359 Package : diffoscope Type : arbitrary file overwrite Remote : No Link : https://security.archlinux.org/AVG-175 Summary ======= The package diffoscope before version 77-1 is vulnerable to arbitrary file overwrite. Resolution ========== Upgrade to 77-1. # pacman -Syu "diffoscope>=77-1" The problem has been fixed upstream in version 77. Workaround ========== None. Description =========== It has been discovered that diffoscope may write to arbitrary locations on disk depending on the contents of an untrusted archive. Impact ====== An attacker is able to create a specially crafted archive that, when processed, overwrites arbitrary files on disc. References ========== https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723 https://anonscm.debian.org/git/reproducible/diffoscope.git/commit/?id=632a40... https://security.archlinux.org/CVE-2017-0359