GHSA-QGFR-5HQP-VRW9 Path Traversal in decompress

Versions of decompress prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing../. Recommendation Upgrade to version 4.2.1 or later...

@angular/benchpress (=0.1.0), @camptocamp/closure-util (>=1.20.0 <=1.27.0) +141 more potentially affected by unknown CVE via decompress-zip (>=0.3.0 <=0.3.1)

decompress-zip NPM version =0.3.0, =1.20.0, =0.4.0, =0.4.0, =0.5.0-beta.2, =1.36.0, =0.0.1, =3.6.0, =1.0.0, =0.1.0, =0.1.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-73V8-V6G4-VRPM...

@achingbrain/ngrok (=0.2.2), @atomist/sdm-automation (>=0.1.16 <=0.1.59-master.20200611224542) +605 more potentially affected by unknown CVE via decompress-zip (>=0.0.2 <=0.2.0)

decompress-zip NPM version =0.0.2, =0.1.16, =14.0.5, =0.1.2, =1.2.6, =1.0.1, =1.0.0, =1.1.1, =5.0.1, =1.0.0, =5.2.1, =5.3.0 - @paulcbetts/squirrel-windows =1.2.1 - @pgswe/ics.js =0.1.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-73V8-V6G4-VRPM...

GHSA-73V8-V6G4-VRPM Arbitrary File Overwrite in decompress-zip

Vulnerable versions of decompress-zip are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because decompress-zip does not verify that extracted files do not resolve to targets outside of the extraction root directory. Recommendation For...

Arbitrary File Overwrite in decompress-zip

Vulnerable versions of decompress-zip are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because decompress-zip does not verify that extracted files do not resolve to targets outside of the extraction root directory. Recommendation For...

grok:grk_decompress_fuzzer: Nested bug in the same thread, aborting. with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6324070826901504 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id: linux Crash Type: Nested bug in the same thread, aborting. Crash Address: Crash State: NULL Sanitizer: memory MSAN...

PT-2020-6423 · Lrzip +3 · Lrzip +3

Name of the Vulnerable Software and Affected Versions: Lrzip version 0.621 Description: A null pointer dereference was discovered in the lzo decompress buf function in stream.c, which allows an attacker to cause a denial of service DOS via a crafted compressed file. This issue can be exploited by...

OSV-2020-1016 UNKNOWN READ in blosc_run_decompression_with_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23717 Crash type: UNKNOWN READ Crash state: bloscrundecompressionwithcontext bloscdecompress fuzzdecompress.c...

grok:grk_decompress_fuzzer: Incorrect-function-pointer-type in grk_read_header

Detailed Report: https://oss-fuzz.com/testcase?key=6269912481005568 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzerubsangrok Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash State: grkreadheader grkdecompressfuzzer.cp...

decompress package path traversal vulnerability

decompress package is a decompression package. A path traversal vulnerability exists in decompress package versions prior to 4.2.1 Node.js. This vulnerability can be exploited to write arbitrary files with the help of the '... /' string to write arbitrary files...

Directory traversal

The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal...

CVE-2020-12265

The CVE-2020-12265 entry concerns the Node.js decompress package before version 4.2.1. Root cause: Directory Traversal via ../ in an archive member when a symlink is used, allowing Arbitrary File Write. Affected software: decompress (Node.js) prior to 4.2.1. Impact statements in the connected doc...

CVE-2020-12265

The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal...

PT-2020-13083

Name of the Vulnerable Software and Affected Versions decompress versions prior to 4.2.1 Description The issue allows for Arbitrary File Write via ../ in an archive member when a symlink is used, due to Directory Traversal. This occurs because the package fails to prevent extraction of files with...

HDF5 Buffer Overflow Vulnerability (CNVD-2020-22284)

HDF5 is a suite of tools for managing and storing different types of data. The product supports managing, manipulating, viewing and analyzing data and generating files in portable formats. A buffer overflow vulnerability exists in the 'Decompress' function of the decompress.c file in HDF5 1.12.0...

CVE-2020-10809

An issue was discovered in HDF5 through 1.12.0. A heap-based buffer overflow exists in the function Decompress located in decompress.c. It can be triggered by sending a crafted file to the gif2h5 binary. It allows an attacker to cause Denial of Service...

DEBIAN-CVE-2020-10809

An issue was discovered in HDF5 through 1.12.0. A heap-based buffer overflow exists in the function Decompress located in decompress.c. It can be triggered by sending a crafted file to the gif2h5 binary. It allows an attacker to cause Denial of Service...

UBUNTU-CVE-2020-10809

An issue was discovered in HDF5 through 1.12.0. A heap-based buffer overflow exists in the function Decompress located in decompress.c. It can be triggered by sending a crafted file to the gif2h5 binary. It allows an attacker to cause Denial of Service...

CVE-2020-10809

CVE-2020-10809 describes a heap-based buffer overflow in HDF5’s Decompress() (decompress.c) that can be triggered by a crafted GIF-to-HDF5 file via the gif2h5 tool, leading to Denial of Service. The vulnerability is within HDF5 up to 1.12.0; multiple connected advisories (SUSE-SU-2022:1912-1 and ...

CVE-2020-10809

An issue was discovered in HDF5 through 1.12.0. A heap-based buffer overflow exists in the function Decompress located in decompress.c. It can be triggered by sending a crafted file to the gif2h5 binary. It allows an attacker to cause Denial of Service...