Zip Slip arbitrary file overwrite vulnerability analysis-vulnerability warning-the black bar safety net

Zip Slip is a widespread arbitrary file overwrite vulnerability, usually leads to remote command execution. The vulnerability affects range greatly: the 1. Affected products: Hewlett-Packard, Amazon, apache, Pivotal, etc.; 2. The affected programming languages: JavaScript, Python, Ruby,. NET, Go,...

Denial Of Service (DoS)

libarchive.so is vulnerable to denial of service DoS attacks. A malicious user can pass a 7z file to the readCodersInfo function in archivereadsupportformat7zip.c to cause a NULL pointer dereference that can crash the application...

Path traversal

Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

CVE-2018-8008

CVE-2018-8008 affects Apache Storm up to 1.0.6, 1.2.1, and 1.1.2, enabling arbitrary file write via specially crafted archives with path traversal filenames that extract outside the target directory. Connected advisories corroborate a ZipSlip-style flaw across multiple Storm releases. Remediation...

CVE-2018-8008

Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

Path traversal

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the filename gets concatenated to th...

CVE-2018-1261

The CVE-2018-1261 entry concerns spring-integration-zip. Affected component: spring-integration-zip prior to version 1.0.1. Vulnerability: arbitrary file write via path traversal in zip archives (including nested formats like zip, tar, 7z, etc.) when a crafted filename is concatenated to the targ...

openSUSE Security Update : p7zip (openSUSE-2018-188)

This update for p7zip fixes the following security issues : - CVE-2016-1372: Fixed multiple vulnerabilities when processing crafted 7z files bsc984650 - CVE-2017-17969: Fixed a heap-based buffer overflow in a shrink decoder bsc1077725 - CVE-2018-5996: Fixed memory corruption in RAR decompression...

SUSE SLED12 / SLES12 Security Update : p7zip (SUSE-SU-2018:0464-1)

This update for p7zip fixes the following issues: Security issues fixed : - CVE-2016-1372: Fixed multiple vulnerabilities when processing crafted 7z files bsc984650 - CVE-2017-17969: Fixed a heap-based buffer overflow in a shrink decoder bsc1077725 - CVE-2018-5996: Fixed memory corruption in RAR...

Libarchive 7zip read_SubStreamsInfo Code Execution Vulnerability(CVE-2016-4300)

SUMMARY An exploitable \heap overflow vulnerability exists in the 7zip readSubStreamsInfo functionality of libarchive. A specially crafted 7zip file can cause a integer overflow resulting in memory corruption that can lead to code execution. An attacker can send a malformed file to trigger this...

Updated clamav packages fix security vulnerability

ClamAV aka Clam AntiVirus before 0.99.2 allows remote attackers to cause a denial of service application crash via a crafted mew packer executable CVE-2016-1371. ClamAV aka Clam AntiVirus before 0.99.2 allows remote attackers to cause a denial of service application crash via a crafted 7z file...

ClamAV < 0.99.2 Multiple Vulnerabilities

Binary data 9793.prm...

CVE-2016-9296

A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause ...

Null pointer dereference

A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause ...

CVE-2016-9296

A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause ...

CVE-2016-9296

The CVE-2016-9296 issue affects p7zip 16.02 and older, caused by a null pointer dereference in CInArchive::ReadAndDecodePackedStreams (CPP/7zip/Archive/7z/7zIn.cpp) used by the 7z.so library and 7z apps. This can crash and trigger a denial of service when decoding malformed 7z files. Remediation ...

CVE-2016-9296

A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause ...

ClamAV < 0.99.1 Multiple Vulnerabilities

Binary data 802032.prm...

ClamAV < 0.99.2 Crafted '7z' And 'Mew Packer' Parsing DoS Vulnerabilities - Windows

ClamAV is prone to multiple denial of service DoS vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:clamav:clamav"...

ClamAV < 0.99.2 Multiple libclamav DoS

According to its version, the ClamAV clamd antivirus daemon running on the remote host is prior to 0.99.2. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists in the libclamav library when handling specially crafted mew packer executables. An...