USN-3685-1: Ruby vulnerabilities

Some of these CVE were already addressed in previous USN: 3439-1, 3553-1, 3528-1. Here we address for the remain releases. It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to cause a buffer overrun. CVE-2017-0898 It was discovered that Ruby incorrectly...

USN-3684-1 perl vulnerability

It was discovered that Perl incorrectly handled certain archive files. An attacker could possibly use this to overwrite arbitrary files...

CVE-2018-0496

Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 as well as in RTsoft's Dink Smallwood HD / ProtonSDK version before 3.14 allow an attacker to overwrite arbitrary files on the user's system...

UBUNTU-CVE-2018-0496

Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 as well as in RTsoft's Dink Smallwood HD / ProtonSDK version before 3.14 allow an attacker to overwrite arbitrary files on the user's system...

CVE-2018-0496

Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 as well as in RTsoft's Dink Smallwood HD / ProtonSDK version before 3.14 allow an attacker to overwrite arbitrary files on the user's system...

CVE-2018-0496

Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 as well as in RTsoft's Dink Smallwood HD / ProtonSDK version before 3.14 allow an attacker to overwrite arbitrary files on the user's system...

CVE-2018-0496

Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 as well as in RTsoft's Dink Smallwood HD / ProtonSDK version before 3.14 allow an attacker to overwrite arbitrary files on the user's system...

CVE-2018-0496

CVE-2018-0496 affects DFArc and DFArc2’s D-Mod extractor (and RTsoft’s Dink Smallwood HD / ProtonSDK before 3.14). A directory traversal flaw allows an attacker to overwrite arbitrary files on the user’s system. Connected advisories confirm vulnerable components include the D-Mod extractor in DFA...

CVE-2018-0496: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 as well as in RTsoft's Dink Smallwood HD / ProtonSDK version before 3.14 allow an attacker to overwrite arbitrary files on the user's system...

CVE-2017-7767

The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows Updater, which runs with the Maintenance Service's privileged access. Note: This attack requires local system access and only affects Windows. Other operati...

Perl Directory Traversal Vulnerability

Perl is a free and powerful cross-platform programming language developed by American programmer Larry Wall.Archive::Tar module is one of the modules used to handle tar files. A security vulnerability exists in the Archive::Tar module in Perl 5.26.2 and earlier. The vulnerability can be exploited...

EUVD-2018-4007

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name...

CVE-2018-12015: Improper Link Resolution Before File Access

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name...

UBUNTU-CVE-2018-12015

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name...

kubernetes: Kubectl copy doesn't check for paths outside of it's destination directory

An improper validation flaw exists in the kubernetes 'kubectl cp' command. An attacker, who could trick a user into using the command to copy files locally from a pod, could override files outside of the target directory of the command...

ZIP Slip Arbitrary File Overwrite Remote Code Execution (CVE-2018-1002200; CVE-2018-1002201; CVE-2018-1002203; CVE-2018-1002204; CVE-2018-1002205; CVE-2018-1002206; CVE-2018-1002207; CVE-2018-1261; CVE-2018-8008; CVE-2018-8009; CVE-2021-43555)

A file overwrite vulnerability exist in archive formats. To trigger this issue, an attacker may create a malicious archive that will exploit this vulnerability. Successful exploitation of this vulnerability would allow a remote attacker to overwrite arbitrary files on the vulnerable system and...

Zip Slip Vulnerability

Challenge Veeam is aware of the Zip Slip Vulnerability, which affects jobs with the guest file system indexing option enabled. Zip Slip is an arbitrary file overwrite vulnerability in multiple ZIP decompression algorithm implementations that affects thousands of software products across many...

'Zip Slip' Vulnerability Affects Thousands of Projects Across Many Ecosystems

Security researchers at British software firm Snyk have revealed details of a critical vulnerability that affects thousands of projects across many ecosystems and can be exploited by attackers to achieve code execution on the target systems. Dubbed "Zip Slip ," the issue is an arbitrary file...

'Zip Slip' Vulnerability Affects Thousands of Projects Across Many Ecosystems

Security researchers at British software firm Snyk have revealed details of a critical vulnerability that affects thousands of projects across many ecosystems and can be exploited by attackers to achieve code execution on the target systems. Dubbed "Zip Slip," the issue is an arbitrary file...

Generic Zip Slip Traversal Vulnerability

This is a generic arbitrary file overwrite technique, which typically results in remote command execution. This targets a simple yet widespread vulnerability that has been seen affecting a variety of popular products including HP, Amazon, Apache, Cisco, etc. The idea is that often archive...