Bug#774716: paxtar: directory traversal vulnerabilities

[Thorsten Glaser <tg@mirbsd.de>]

Alexander Cherepanov dixit:

> 1. paxtar will extract files with .. components in names.

> 2. While extracting an archive, it will extract symlinks and then follow them
> if they are referenced in further entries.

Please check if any of these are required by POSIX and, if not,
report this bug to OpenBSD. The code is indirectly derived from
their src/bin/pax/ in CVS.

Thanks,
//mirabilos
-- 
> Hi, does anyone sell openbsd stickers by themselves and not packaged
> with other products?
No, the only way I've seen them sold is for $40 with a free OpenBSD CD.
	-- Haroon Khalid and Steve Shockley in gmane.os.openbsd.misc