unzip and tar vulnerabilities packages fix vulnarabilities

hello people got this in my inbox from redhat
its a vularibilty in tar and unzip i have copy pasted the email in for you to read

redhat network has determained that the
following advisory is applicable to
one or more of the systems you have registered:

Complete information about this errata can be found at the following location:
https://rhn.redhat.com/network/errat...s.pxt?eid=1180

Security Advisory - RHSA-2002:096-24
------------------------------------------------------------------------------
Summary:
Updated unzip and tar packages fix vulnerabilities

The unzip and tar utilities contain vulnerabilities which can allow
arbitrary files to be overwritten during archive extraction.

Description:
The unzip and tar utilities are used for manipulating archives, which
are multiple files stored inside of a single file.

A directory traversal vulnerability in unzip version 5.42 and earlier,
as well as GNU tar 1.13.19 and earlier, allows attackers to overwrite
arbitrary files during archive extraction via a ".." (dot dot) in an
extracted filename. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2001-1267 and CAN-2001-1268 to
this issue.

In addition, unzip version 5.42 and earlier also allows attackers to
overwrite arbitrary files during archive extraction via filenames in the
archive that begin with the "/" (slash) character. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2001-1269 to this issue.

During testing of the fix to GNU tar, it was discovered that GNU tar
1.13.25 was still vulnerable to a modified version of the same problem. Red
Hat has provided a patch to tar 1.3.25 to correct this problem. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2002-0399 to this issue.

Users of unzip and tar are advised to upgrade to these errata packages,
containing unzip version 5.50 (for Red Hat Linux 6.2, 7, 7.1, and 7.2) and
a patched version of GNU tar 1.13.25 (for Red Hat Linux 6.2, 7, 7.1, 7.2,
and 7.3), which are not vulnerable to these issues.

Important Note: For users of Red Hat Linux 6.2 and 7 only, these errata
packages change one of the command line options for tar. Previously the
'-I' option was used to enable bzip2 compression, while in these errata
packages the option has changed to '-j'.

References:
http://online.securityfocus.com/archive/1/196445
------------------------------------------------------------------------------

-------------
Taking Action
-------------
You may address the issues outlined in this advisory in two ways:

- select your server name by clicking on its name from the list
available at the following location, and then schedule an
errata update for it:
https://rhn.redhat.com/network/syste...ystem_list.pxt

- run the Update Agent on each affected server.


---------------------------------
Changing Notification Preferences
---------------------------------
To enable/disable your Errata Alert preferences globally please log in to RHN
and navigate from "Your RHN" / "Your Account" to the "Preferences" tab.

URL: https://rhn.redhat.com/network/my_account/my_prefs.pxt

You can also enable/disable notification on a per system basis by selecting an
individual system from the "Systems List". From the individual system view
click the "Details" tab.


----------------
Affected Systems
----------------
According to our records, this errata may apply to one or more of the
systems that you've profiled with Red Hat Network. To see precisely which
systems are affected, please go to:
https://rhn.redhat.com/network/errat...d.pxt?eid=1180