Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the MiniZip function in zlib, by providing a long filename, comment, or extra field. Remediation Upgrade zlib to version 1.3.1 or higher. References - GitHub Commit - GitHub PR - Vulnerable Code...

AZL-31298 CVE-2023-45853 affecting package cloud-hypervisor for versions less than 32.0-2

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an...

AZL-38040 CVE-2023-45853 affecting package keras for versions less than 3.1.1-1

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an...

AZL-43609 CVE-2023-45853 affecting package blosc 1.21.4-2

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an...

Code Injection

firefox-esr is vulnerable to Code Injection. This vulnerability arises from the use of newline characters in filenames, which could bypass file extension security mechanisms that replace malicious extensions e.g., .lnk with .download. This allows an attacker to inject and execute malicious code...

Improper Neutralization Of Filename Or Path

github.com/schollz/croc is vulnerable to Improper Neutralization Of Filename Or Path. The vulnerability is due to a lack of filenames filtering or received from the client side. This allows an attacker to use filenames with special characters, including ANSI/CSI terminal escape sequences. The...

Croc Security Breach

croc is a tool from the individual developers at Zack that allows any two computers to simply and securely transfer files and folders. A security vulnerability exists in Croc version 9.6.5 and earlier versions, which originates from a sender being able to place an ANSI or CSI escape sequence in a...

PHPFusion Security Vulnerability

PHPFusion is a Malaysian PHPFusion company based on MySql and PHP open source lightweight content management system . The system contains modules for news, articles and forums. A security vulnerability exists in PHPFusion that stems from inadequate cleanup of tainted filenames, allowing the...

USN-6333-1: Thunderbird vulnerabilities

Junsung Lee discovered that Thunderbird did not properly validate the text direction override unicode character in filenames. An attacker could potentially exploits this issue by spoofing file extension while attaching a file in emails. CVE-2023-3417 Max Vlasov discovered that Thunderbird Offscre...

Filename spoofing in archive

An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing...

Filename spoofing in archive

An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing...

CVE-2023-39137

An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing...

CVE-2023-39137

An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing...

CVE-2023-39137

An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing...

PT-2023-26799 · Archive · Archive

Name of the Vulnerable Software and Affected Versions: Archive version 3.3.7 Description: The issue allows attackers to spoof zip filenames, leading to inconsistent filename parsing. Recommendations: For Archive version 3.3.7, consider restricting the parsing of zip filenames to minimize the risk...

CVE-2023-39137

An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing...

CVE-2023-39137

An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing...

PT-2023-28277 · Trane · Trane Pivot +3

Name of the Vulnerable Software and Affected Versions: Trane XL824, XL850, XL1050, and Pivot thermostats affected versions not specified Description: A command injection issue exists, allowing an attacker to execute arbitrary commands as root using a specially crafted filename. This requires...

WebUI-Aria2 路径遍历漏洞

WebUI-Aria2 is an application for hamza zia personal developers. It is used to create interfaces to interact with aria2. A path traversal vulnerability exists in WebUI-Aria2 version 4fe2e, which stems from accepting filenames from URL input without cleaning them up...

OESA-2023-1519 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...