Quantum-compressed block of exactly 38912 bytes will write one byte
beyond the end of the input buffer", also improves the --fix option.
ok jasper@ and "Steve" (maintainer) "OK'd my update earlier this week
which was the same as your diff below except for the HOMEPAGE change."
This release fixes the extraction to absolute file names with invalid
UTF-8 characters (CVE-2015-2060), which had already been fixed in
the port.
The security patch in the port for CVE-2014-9556 was already obsoleted
by extended input validation in 1.5.
ok jca@
security fixes (see recent commit to archivers/libmspack), additionally
cabextract now replaces bad Unicode characters in filenames with the
standard Unicode replacement character.
upgrade to 1.1;
A directory-traversal issue exists in cabextract
that could overwrite any file on the system when extracting
a malicious cab file.
from maintainer; the issue has also been reported by matthieu@
