[SECURITY] Fedora 36 Update: golang-github-sophaskins-efs2tar-0-0.5.20210317git4db1b0f.fc36

efs2tar is a tool that converts SGI EFS-formatted filesystem images ie, the result of dd-ing a whole device in to a file in to tarballs. It was based entirely on NetBSD's sys/fs/efs...

[SECURITY] Fedora 35 Update: golang-github-sophaskins-efs2tar-0-0.4.20210317git4db1b0f.fc35

efs2tar is a tool that converts SGI EFS-formatted filesystem images ie, the result of dd-ing a whole device in to a file in to tarballs. It was based entirely on NetBSD's sys/fs/efs...

CVE-2022-1664

Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction ca...

OESA-2022-1584 nodejs-fstream security update

Provides advanced file system stream objects for Node.js. These objects are like FS streams, but with stat on them, and support directories and symbolic links, as well as normal files. Also, you can use them to set the stats on a file, even if you don't change its contents, or to create a symlink...

USN-4863-1 node-fstream vulnerability

It was discovered that fstream incorrectly handled certain crafted tarballs. An attacker could use this vulnerability to write arbitrary files to the filesystem...

USN-4863-1: fstream vulnerability

It was discovered that fstream incorrectly handled certain crafted tarballs. An attacker could use this vulnerability to write arbitrary files to the filesystem...

CVE-2021-21272

A flaw was found in oras. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking,...

CVE-2021-21272

ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the downloade...

Buffer overflow

ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the downloade...

CVE-2021-21272 zip slip in ORAS

ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the downloade...

CVE-2021-21272

CVE-2021-21272 affects ORAS prior to 0.9.0, where the archive extraction feature (zip-slip via directory support) can write/overwrite files outside the target directory when processing crafted tarballs. This impacts ORAS CLI users running oras pull or Go programs using github.com/deislabs/oras/pk...

OPENSUSE-SU-2020:1254-1 Security update for python

This update for python fixes the following issues: - CVE-2019-20907: Avoid a possible infinite loop caused by specifically crafted tarballs bsc1174091. This update was imported from the SUSE:SLE-15:Update update project...

Security update for python (moderate)

openSUSE Security Update: Security update for python Announcement ID: openSUSE-SU-2020:1257-1 Rating: moderate References: 1174091 Cross-References: CVE-2019-20907 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for python...

SUSE SLES12 Security Update : python (SUSE-SU-2020:2275-1)

This update for python fixes the following issues : CVE-2019-20907: Avoid a possible infinite loop caused by specifically crafted tarballs bsc1174091. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted t...

CVE-2019-13173

fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter function is...

Ubuntu 18.04 LTS : npm/fstream vulnerability (USN-4123-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4123-1 advisory. It was discovered that npm/fstream incorrectly handled certain crafted tarballs. An attacker could use this vulnerability to write aritrary files to the filesyste...

USN-4123-1: npm/fstream vulnerability

It was discovered that npm/fstream incorrectly handled certain crafted tarballs. An attacker could use this vulnerability to write aritrary files to the filesystem...

nodejs-tar: Arbitrary file overwrites when extracting tarballs containing a hard-link

A flaw was found in nodejs-tar in versions prior to 4.4.2. An arbitrary file overwrite can occur when extracting tarballs containing a hard-link to a file that already exists in the system. Further, a file that matches the hard-link may overwrite the system's files with the contents of the...

CVE-2019-13173

fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter function is...

CVE-2019-13173

fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter function is...