7307 matches found
CVE-2014-3697
Absolute path traversal vulnerability in the untarblock function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitrary files via a drive name in a tar archive of a smiley theme...
CVE-2014-3697
The CVE-2014-3697 issue affects Pidgin for Windows, where the untar_block function in win32/untar.c allows absolute path traversal via a tar archive’s drive name in a smiley theme. This enables remote attackers to write files to arbitrary locations on the victim system. Public references indicate...
CVE-2014-3697
Absolute path traversal vulnerability in the untarblock function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitrary files via a drive name in a tar archive of a smiley theme...
PT-2014-5458
Name of the Vulnerable Software and Affected Versions Pidgin versions prior to 2.10.10 Description The issue is related to an absolute path traversal vulnerability in the untar block function. This vulnerability allows remote attackers to write to arbitrary files via a drive name in a tar archive...
[SECURITY] Fedora 20 Update: ark-4.14.1-1.fc20
Ark is a program for managing various archive formats. Archives can be viewed, extracted, created and modified from within Ark. The program can handle various formats such as tar, gzip, bzip2, zip, rar and lha if appropriate command-line programs are installed...
GNU Tar 1.1x GNUTYPE_NAMES Remote Directory Traversal Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/21235/info GNU Tar is prone to a vulnerability that may allow an attacker to place files and overwrite files in arbitrary locations on a vulnerable computer. These issues present themselves when the application processes...
GNU TAR <= 1.15.91 and CPIO <= 2.5.90 safer_name_suffix Remote Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/26445/info GNU's tar and cpio utilities are prone to a denial-of-service vulnerability because of insecure use of the 'alloca' function. Successfully exploiting this issue allows attackers to crash the affected utilities...
PT-2014-5359 · Red Hat · Openshift Origin +1
Name of the Vulnerable Software and Affected Versions: OpenShift Origin and Enterprise versions 1.2.8 through 2.1.1 Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with certain file extensions in a cartridge manifest fil...
openSUSE Security Update : emacs and depending packages (openSUSE-SU-2012:1348-1)
This update fixes the following issues for emacs, emacs-w3, gnuplot and ddskk: emacs : - Add fix for bnc775993 which disable arbitrary lisp code execution when 'enable-local-variables' is set to ':safe' CVE-2012-3479 - Add fix for bnc780653 to allow emacs to parse tar archives with PAX extended...
PT-2014-2135
Name of the Vulnerable Software and Affected Versions Update Manager versions 1:0.87.31.1 and earlier, versions 1:0.134.x through 1:0.134.10.1, versions 1:0.142.x through 1:0.142.22.1, versions 1:0.150.x through 1:0.150.4.1, versions 1:0.152.x through 1:0.152.25.4 Description The issue allows...
Multiple Antivirus Products TAR file parser Security Bypass - Ver2 (CVE-2012-1459)
A security bypass vulnerability has been reported in multiple antivirus products. A remote attacker could Successful exploitation of this vulnerability by using a specailly crafted TAR archive with a Tar archive entry with a length field corresponding to that entire entry, plus part of the header...
CVE-2014-2090
Multiple cross-site scripting XSS vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 tar, 2 tarval, or 3 title parameter...
CVE-2014-2090
Multiple cross-site scripting XSS vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 tar, 2 tarval, or 3 title parameter...
CVE-2014-2090
Multiple cross-site scripting XSS vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 tar, 2 tarval, or 3 title parameter...
CVE-2014-2090: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 tar, 2 tarval, or 3 title parameter...
PT-2014-4478
Name of the Vulnerable Software and Affected Versions ILIAS version 4.4.1 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML. The vulnerable parameters are tar, tar val, an...
Updated libtar package fixes security vulnerability
A directory traversal attack was reported against libtar, a C library for manipulating tar archives. The application does not validate the filenames inside the tar archive, allowing to extract files in arbitrary path. An attacker can craft a tar file to override files beyond the tarextractglob an...
MGASA-2014-0090 Updated libtar package fixes security vulnerability
A directory traversal attack was reported against libtar, a C library for manipulating tar archives. The application does not validate the filenames inside the tar archive, allowing to extract files in arbitrary path. An attacker can craft a tar file to override files beyond the tarextractglob an...
AZL-6651 CVE-2013-4420 affecting package libtar for versions less than 1.2.20-8
Multiple directory traversal vulnerabilities in the 1 tarextractglob and 2 tarextractall functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. dot dot in a crafted tar file...
DEBIAN-CVE-2013-4420
Multiple directory traversal vulnerabilities in the 1 tarextractglob and 2 tarextractall functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. dot dot in a crafted tar file...