6018 matches found
Pear Archive_Tar Backlink Vulnerability
Pear ArchiveTar is a Php-based software from the Pear PEAR team that allows for the creation, extraction, etc. of tarballs. ArchiveTar through 1.4.11 suffers from a backlink vulnerability that allows write operations via directory traversal...
PT-2021-2811 · Gnu +5 · Tar +5
Name of the Vulnerable Software and Affected Versions: tar versions 1.33 and earlier Description: A flaw in the src/list.c of tar allows an attacker who can submit a crafted input file to cause uncontrolled consumption of memory, potentially leading to system availability issues. The vulnerabilit...
CVE-2021-21251
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3 there is a critical "zip slip" vulnerability. This issue may lead to arbitrary file write. The KubernetesResource REST endpoint untars user controlled data from the request body using TarUtils. TarUtils is a custom library...
Denial Of Service (DoS)
tar is vulnerable to denial of service. A NULL pointer dereference in paxdecodeheader in sparse.c when parsing certain archives that contain malicious extended headers allows an attacker to crash the application...
Ubuntu: Security Advisory (USN-4692-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : tar vulnerabilities (USN-4692-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4692-1 advisory. Chris Siebenmann discovered that tar incorrectly handled extracting files resized during extraction when invoked with the --spars...
USN-4692-1 tar vulnerabilities
Chris Siebenmann discovered that tar incorrectly handled extracting files resized during extraction when invoked with the --sparse flag. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM, Ubuntu 16.04 LTS and Ubuntu...
USN-4692-1: tar vulnerabilities
Chris Siebenmann discovered that tar incorrectly handled extracting files resized during extraction when invoked with the --sparse flag. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM, Ubuntu 16.04 LTS and Ubuntu...
SUSE-SU-2021:0115-1 Security update for rubygem-archive-tar-minitar
This update for rubygem-archive-tar-minitar fixes one security issue: - CVE-2016-10173: Archives with files containing '..' in the extracted filename could have been used to overwrite arbitrary files bsc1021740...
CVE-2020-29529
HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0...
Moderate Photon OS Security Update - PHSA-2021-0352
Updates of 'linux', 'linux-esx' packages of Photon OS have been released...
SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:3930-1)
This update for python3 fixes the following issues : Fixed CVE-2020-27619 bsc1178009, where Lib/test/multibytecodecsupport calls eval on content retrieved via HTTP. Change setuptools and pip version numbers according to new wheels Handful of changes to make python36 compatible with SLE15 and SLE1...
Debian DSA-4817-1 : php-pear - security update
Two vulnerabilities were discovered in the PEAR ArchiveTar package for handling tar files in PHP, potentially allowing a remote attacker to execute arbitrary code or overwrite files. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...
[SECURITY] [DSA 4817-1] php-pear security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4817-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 19, 2020 https://www.debian.org/security/faq -...
Huawei EulerOS: Security Advisory for file-roller (EulerOS-SA-2020-2545)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS 2.0 SP5 : file-roller (EulerOS-SA-2020-2545)
According to the version of the file-roller packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive...
CVE-2020-27833
A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafted raw container image .tar file which contains symbolic links. The vulnerability is limited to the command oc image extract. If a symbolic link is first...
Debian DSA-4808-1 : apt - security update
It was discovered that missing input validation in the ar/tar implementations of APT, the high level package manager, could cause out-of-bounds reads or infinite loops, resulting in denial of service when processing malformed deb files. C Tenable Network Security, Inc. The descriptive text and...
SUSE SLES12 Security Update : tar (SUSE-SU-2020:2806-1)
This update for tar fixes the following issues : Security issues fixed : CVE-2019-9923: Fixed a denial of service while parsing certain archives with malformed extended headers in paxdecodeheader bsc1130496. CVE-2018-20482: Fixed a denial of service when the '--sparse' option mishandles file...