The vulnerability of the Apache Commons Compress library, related to the allocation of unlimited memory, allows attackers to cause a service failure.

The vulnerability of the Apache Commons Compress library is related to the allocation of unlimited memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by using specially created TAR format files...

Security Bulletin: IBM Content Navigator is vulnerable to a denial of service vulnerabilty.

Summary IBM Content Navigator has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2021-35516 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error when allocate large amounts of memory. By persuading a victim to open ...

CVE-2021-38511

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal...

CVE-2021-38511

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal...

DEBIAN-CVE-2021-38511

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal...

CVE-2021-38511

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal...

CVE-2021-38511

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal...

Design/Logic Flaw

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal...

UBUNTU-CVE-2021-38511

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal...

CVE-2021-38511

CVE-2021-38511 affects the Rust tar crate prior to 0.4.36. When a TAR archive contains symlinks, extraction can perform a directory traversal with “..”, potentially creating arbitrary directories. Practical impact is described as partial integrity/authoritative access loss during extraction; expl...

CVE-2021-38511

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal...

Path Traversal

github.com/gen2brain/go-unarr is vulnerable to path traversal. The vulnerability exists because it does not check the contents of the archive, allowing an attacker to use ../ in a pathname within a TAR archive.By triggering the path traversal vulnerability, an attacker can store any file in any...

go-unarr directory traversal vulnerability

go-unarr is an open source go language library for decompressing RAR, TAR, ZIP and 7z archives. go-unarr version 0.1.1 is vulnerable to a directory traversal vulnerability that could be exploited to write arbitrary files on the system via specially crafted TAR archives...

Alexcrichton Tar-rs 路径遍历漏洞

Alexcrichton Tar-rs is a tar archive read/write library for Rust. A path traversal vulnerability exists in Alexcrichton Tar-rs, which stems from a logical error in the implementation of the product's decompression feature, and could allow an attacker to create files in other directories by...

Security update for apache-commons-compress (important)

openSUSE Security Update: Security update for apache-commons-compress Announcement ID: openSUSE-SU-2021:1115-1 Rating: important References: 1188463 1188464 1188465 1188466 Cross-References: CVE-2021-35515 CVE-2021-35516 CVE-2021-35517 CVE-2021-36090 CVSS scores: CVE-2021-35515 NVD : 7.5...

OPENSUSE-SU-2021:1115-1 Security update for apache-commons-compress

This update for apache-commons-compress fixes the following issues: - Updated to 1.21 - CVE-2021-35515: Fixed an infinite loop when reading a specially crafted 7Z archive. bsc1188463 - CVE-2021-35516: Fixed an excessive memory allocation when reading a specially crafted 7Z archive. bsc1188464 -...

CVE-2021-38197

unarr.go in go-unarr aka Go bindings for unarr 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive...

Directory traversal

unarr.go in go-unarr aka Go bindings for unarr 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive...

CVE-2021-38197

CVE-2021-38197 affects go-unarr (Go bindings for unarr) version 0.1.1, where a Directory Traversal flaw allows the use of .. in TAR archive paths to access files outside the intended directory. This vulnerability is corroborated across multiple sources (NVD entry, GHSA, OSV, Veracode, CNVD, and o...

go-unarr 路径遍历漏洞

go-unarr is an open source go language library for decompressing RAR, TAR, ZIP and 7z archives. go-unarr version 0.1.1 is vulnerable to a directory traversal vulnerability that could be exploited to write arbitrary files on the system via specially crafted TAR archives...