OSV-2017-65 Use-of-uninitialized-value in Archive::GetComment

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4275 Crash type: Use-of-uninitialized-value Crash state: Archive::GetComment Archive::ViewComment CmdExtract::ExtractArchive...

USN-4692-1 tar vulnerabilities

Chris Siebenmann discovered that tar incorrectly handled extracting files resized during extraction when invoked with the --sparse flag. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM, Ubuntu 16.04 LTS and Ubuntu...

SUSE-SU-2021:0115-1 Security update for rubygem-archive-tar-minitar

This update for rubygem-archive-tar-minitar fixes one security issue: - CVE-2016-10173: Archives with files containing '..' in the extracted filename could have been used to overwrite arbitrary files bsc1021740...

OSV-2017-25 Use-of-uninitialized-value in ToPercent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4512 Crash type: Use-of-uninitialized-value Crash state: ToPercent Archive::ReadHeader15 Archive::ReadHeader...

OSV-2017-14 Use-of-uninitialized-value in Archive::ConvertFileHeader

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4614 Crash type: Use-of-uninitialized-value Crash state: Archive::ConvertFileHeader Archive::ReadHeader15 Archive::ReadHeader...

OSV-2017-3 Use-of-uninitialized-value in Archive::GetComment

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4610 Crash type: Use-of-uninitialized-value Crash state: Archive::GetComment Archive::ViewComment CmdExtract::ExtractArchive...

CVE-2020-8570

Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process...

Researcher Builds Parler Archive Amid Amazon Suspension

A security researcher said she has scraped and is archiving 99 percent of Parler’s public posts, as the social-media network goes offline following suspensions from Amazon, Apple and Google. Archived content includes public posts from the social-media site. These posts reportedly included Parler...

R Cran Path Traversal Vulnerability

R Cran is a default package manager for the R programming language from the R Foundation. CRAN has a security vulnerability that can be exploited by an attacker to crash an application...

Hackers Using Fake Trump's Scandal Video to Spread QNode Malware

Cybesecurity researchers today revealed a new malspam campaign that distributes a remote access Trojan RAT by purporting to contain a sex scandal video of U.S. President Donald Trump. The emails, which carry with the subject line "GOOD LOAN OFFER!!," come attached with a Java archive JAR file...

Automattic: information disclosure lead to disclose users private notes

dear automattic the bug i will share with you a bug that allow attackers to access users notes without permission the bug is here http://simp.ly/p and here http://app.simplenote.com/ and its using web.archive.org website web archive: is a website like google search but he save all links like you...

Huawei EulerOS: Security Advisory for file-roller (EulerOS-SA-2020-2545)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : file-roller (EulerOS-SA-2020-2545)

According to the version of the file-roller packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive...

WordPress Total Upkeep plugin <= 1.14.9 - Unauthenticated Backup Archive Download vulnerability

Unauthenticated Backup Archive Download vulnerability found by Wadeek in WordPress Total Upkeep plugin versions = 1.14.9. Solution Update the WordPress Total Upkeep plugin to the latest available version at least 1.14.10...

lambda_pattern (>=0.0.15, <=0.0.31), push2cloud-cli (>=1.0.0, <=2.0.3) +3 more potentially affected by CVE-2020-28422 via git-archive (0.1.4)

git-archive NPM version 0.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on git-archive and may be impacted: - lambdapattern =0.0.15, =1.0.0, =1.0.0, =2.0.4 - push2cloud-compiler-rf 2.0.2 Source cves: CVE-2020-28422 Source advisory:...

Command Injection

Overview git-archive is a module to take a bare git repo, archive it, and export it as a tarball to a given path Affected versions of this package are vulnerable to Command Injection via the exports function. Remediation There is no fixed version for git-archive. Credit: JHU System Security Lab...

MGASA-2020-0453 Updated php-pear packages fix security vulnerabilities

Filename manipulation vulnerabilities CVE-2020-28948 / CVE-2020-28949 Updated also ArchiveTar to 1.4.11...

Arbitrary File Write

binutils is vulnerable to directory traversal. Local users are able to delete arbitrary files via a ../ in the file name or an absolute path name in a malicious archive to strip or perform an objcopy or create arbitrary files...

Content Injection

GNU Mailman is vulnerable to content injection. An attacker is able to inject arbitrary content into the application via the Cgi/private.py private archive login page...

PT-2020-17183 · Hashicorp · Go-Slug

Name of the Vulnerable Software and Affected Versions: HashiCorp go-slug versions 0.4.3 and earlier Description: The issue allows a malicious attacker to bypass protections against directory traversal during archive extraction by chaining multiple symbolic links within the archive. This enables t...