[SECURITY] Fedora 24 Update: libarchive-3.1.2-17.fc24

Libarchive is a programming library that can create and read several differ ent streaming archive formats, including most popular tar variants, several cpio formats, and both BSD and GNU ar variants. It can also write shar archives and read ISO9660 CDROM images and ZIP archives...

Amazon Linux: Security Advisory (ALAS-2016-685)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-0857

Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a 1 tar file or 2 file within a tar file...

Design/Logic Flaw

Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a 1 tar file or 2 file within a tar file...

UBUNTU-CVE-2015-0857

Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a 1 tar file or 2 file within a tar file...

DEBIAN-CVE-2015-0857

Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a 1 tar file or 2 file within a tar file...

CVE-2015-0857

Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a 1 tar file or 2 file within a tar file...

CVE-2015-0857

Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a 1 tar file or 2 file within a tar file...

TarDiff Command Injection Vulnerability

TarDiff is a package comparison tool developed by software developer Josef Spillner. A command injection vulnerability exists in TarDiff. The vulnerability can be exploited to inject arbitrary shell commands by using shell metacharacters in tar file names or filenames in tar files...

PHP tar/zip/phar parser denial of service vulnerability

PHP is an open source general-purpose computer scripting language. A security vulnerability in PHP's tar/zip/phar parser allows remote attackers to use the vulnerability to construct malicious compressed files that can be tricked into being parsed by the user, crashing the application...

UBUNTU-CVE-2016-4343

The pharmakedirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service uninitialized pointer dereference or possibly have unspecified other impact via a crafted TAR archi...

UBUNTU-CVE-2016-4342

ext/phar/pharobject.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompressed data, which allows remote attackers to cause a denial of service heap memory corruption or possibly have unspecified other impact via a crafted 1 TAR, 2 ZIP, or 3 PHAR archive...

CVE-2016-4343

The pharmakedirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service uninitialized pointer dereference or possibly have unspecified other impact via a crafted TAR archi...

CVE-2016-4342

ext/phar/pharobject.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompressed data, which allows remote attackers to cause a denial of service heap memory corruption or possibly have unspecified other impact via a crafted 1 TAR, 2 ZIP, or 3 PHAR archive...

Joyent Node.js tar Sensitive Information Disclosure Vulnerability

Joyent Node.js is a web application platform built on top of Google's V8 JavaScript engine. A security vulnerability in the Joyent Node.js tar allows remote attackers to overwrite and extract targets outside of a specific directory via a symbolic link attack...

Medium: php56, php55

Issue Overview: A stack overflow vulnerability was reported that may occur when decompressing tar archives due to phartarwriteheaders potentially copying non-terminated linknames from entries parsed by pharparsetarfile. Affected Packages: php56, php55 Issue Correction: Run yum update php56 or yum...

openSUSE Security Update : php5 (openSUSE-2016-323)

This update for php5 fixes the following issues : - CVE-2016-2554: A stack overflow vulnerability when decompressing tar phar archives was fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Updat...

CVE-2016-2554

Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted TAR archive...

UBUNTU-CVE-2016-2554

Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted TAR archive...

Amanda 3.3.1 amstar Command Injection

AMANDA, the Advanced Maryland Automatic Network Disk Archiver, is a backup solution that allows the IT administrator to set up a single master backup server to back up multiple hosts over network to tape drives/changers or disks or optical media. Amanda uses native utilities and formats e.g. dump...