CVE-2018-8008

Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

CVE-2018-8008

CVE-2018-8008 affects Apache Storm up to 1.0.6, 1.2.1, and 1.1.2, enabling arbitrary file write via specially crafted archives with path traversal filenames that extract outside the target directory. Connected advisories corroborate a ZipSlip-style flaw across multiple Storm releases. Remediation...

Path traversal

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the filename gets concatenated to th...

CVE-2018-1261

The CVE-2018-1261 entry concerns spring-integration-zip. Affected component: spring-integration-zip prior to version 1.0.1. Vulnerability: arbitrary file write via path traversal in zip archives (including nested formats like zip, tar, 7z, etc.) when a crafted filename is concatenated to the targ...

PT-2018-11290

Name of the Vulnerable Software and Affected Versions Spring-integration-zip versions prior to 1.0.1 Description The issue allows for an arbitrary file write, which can be achieved by using a specially crafted zip archive that holds path traversal filenames. This affects not only zip archives but...

CVE-2018-1261: Improper Limitation of a Pathname to a Restricted Directory

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the filename gets concatenated to th...

EulerOS 2.0 SP1 : cpio (EulerOS-SA-2016-1041)

According to the versions of the cpio package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - GNU cpio copies files into or out of a cpio or tar archive. Archives are files which contain a collection of other files plus information about the...

[SECURITY] Fedora 25 Update: libarchive-3.2.2-2.fc25

Libarchive is a programming library that can create and read several differ ent streaming archive formats, including most popular tar variants, several cpio formats, and both BSD and GNU ar variants. It can also write shar archives and read ISO9660 CDROM images and ZIP archives...

[SECURITY] Fedora 26 Update: libarchive-3.2.2-4.fc26

Libarchive is a programming library that can create and read several differ ent streaming archive formats, including most popular tar variants, several cpio formats, and both BSD and GNU ar variants. It can also write shar archives and read ISO9660 CDROM images and ZIP archives...

openSUSE Security Update : cpio (openSUSE-2017-209)

This update for cpio fixes two issues. This security issue was fixed : - CVE-2016-2037: The cpiosafernamesuffix function in util.c in cpio allowed remote attackers to cause a denial of service out-of-bounds write via a crafted cpio file bsc963448. This non-security issue was fixed : - bsc1020108:...

SUSE SLED12 / SLES12 Security Update : cpio (SUSE-SU-2017:0366-1)

This update for cpio fixes two issues. This security issue was fixed : - CVE-2016-2037: The cpiosafernamesuffix function in util.c in cpio allowed remote attackers to cause a denial of service out-of-bounds write via a crafted cpio file bsc963448. The update package also includes non-security...

SUSE-SU-2017:0366-1 Security update for cpio

This update for cpio fixes two issues. This security issue was fixed: - CVE-2016-2037: The cpiosafernamesuffix function in util.c in cpio allowed remote attackers to cause a denial of service out-of-bounds write via a crafted cpio file bsc963448. This non-security issue was fixed: - bsc1020108:...

Updated dracut packages fix security vulnerability

A local information disclosure issue was found in dracut when generating initramfs images with world-readable permissions when "early cpio" is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or...

PT-2018-5040

Name of the Vulnerable Software and Affected Versions dracut versions prior to 045 Description A local information disclosure issue was found when generating initramfs images with world-readable permissions, particularly when 'early cpio' is used, such as including microcode updates. This allows ...

ALPINE-CVE-2016-4809

The archivereadformatcpioreadheader function in archivereadsupportformatcpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service application crash via a CPIO archive with a large symlink...

DEBIAN-CVE-2016-4809

The archivereadformatcpioreadheader function in archivereadsupportformatcpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service application crash via a CPIO archive with a large symlink...

Code injection

The archivereadformatcpioreadheader function in archivereadsupportformatcpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service application crash via a CPIO archive with a large symlink...

CVE-2016-4809

The archivereadformatcpioreadheader function in archivereadsupportformatcpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service application crash via a CPIO archive with a large symlink...

CVE-2016-4809

The archivereadformatcpioreadheader function in archivereadsupportformatcpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service application crash via a CPIO archive with a large symlink...

CVE-2016-4809

The archivereadformatcpioreadheader function in archivereadsupportformatcpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service application crash via a CPIO archive with a large symlink...