GNU Libextractor Buffer Overflow Vulnerability

GNU Libextractor is a set of libraries developed by the GNU Project for extracting metadata from files. A stack-based buffer overflow vulnerability exists in the 'ecreadfilefunc' function unzip.c file in GNU Libextractor versions prior to 1.7. An attacker can exploit this vulnerability to execute...

CVE-2018-14346

GNU Libextractor before 1.7 has a stack-based buffer overflow in ecreadfilefunc unzip.c...

openSUSE Security Update : unzip (openSUSE-2018-709)

This update for unzip fixes the following issues : - CVE-2014-9636: Prevent denial of service out-of-bounds read or write and crash via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression bsc914442 -...

Security update for unzip (moderate)

This update for unzip fixes the following issues: - CVE-2014-9636: Prevent denial of service out-of-bounds read or write and crash via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression bsc914442 -...

SUSE-SU-2018:1883-1 Security update for unzip

This update for unzip fixes the following issues: - CVE-2014-9636: Prevent denial of service out-of-bounds read or write and crash via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression bsc914442 -...

EulerOS 2.0 SP3 : unzip (EulerOS-SA-2018-1170)

According to the versions of the unzip package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Buffer overflow in the listfiles function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service crash via vectors...

Security Bulletin: Multiple vulnerabilities in unzip affect IBM Flex System Manager (FSM)

Summary Multiple vulnerabilities have been identified in unzip that is embedded in the FSM. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2016-9844 DESCRIPTION: Info-Zip UnZip is vulnerable to a denial of service, caused by buffer overflow in zishort function in...

Security Bulletin: Multiple Unzip vulnerabilities affect PowerKVM (Multiple CVEs)

Summary PowerKVM is affected by several vulnerabilities in OpenSSL. Vulnerability Details CVEID: CVE-2014-8139 DESCRIPTION: Info-ZIP UnZip is vulnerable to a heap-based buffer overflow, caused by improper bounds checking within the CRC32 verification. A lo CVSS Base Score: 4.4 CVSS Temporal Score...

Security Bulletin: Multiple vulnerabilities in unzip, krb5, tomcat, affect IBM SmartCloud Provisioning for IBM Software Virtual Appliance

Summary Multiple vulnerabilities in unzip, krb5, tomcat, affect IBM SmartCloud Provisioning 2.1 for IBM Software Virtual Appliance CVE-2014-8139, CVE-2014-8140, CVE-2014-8141, CVE-2014-9636, CVE-2014-5355, CVE-2014-9421, CVE-2014-5352, CVE-2014-5353, CVE-2014-9422, CVE-2014-0227. Vulnerability...

Security Bulletin: Vulnerability in Apache Tomcat affects Rational Lifecycle Integration Adapter for HP ALM (CVE-2016-3092)

Summary Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component, and is supplied with specific versions of Rational Lifecycle Integration Adapter for HP ALM. By sending file upload requests, an attacker could exploit this vulnerability to...

Security Bulletin: Vulnerabilities in unzip affect IBM Security Network Protection (CVE-2014-8139, CVE-2014-8140, CVE-2014-8141, and CVE-2014-9636 )

Summary The unzip utility is used to list, test, or extract files from a zip archive. Security vulnerabilities have been discovered in unzip used with IBM Security Network Protection. Vulnerability Details CVE ID: CVE-2014-8139 DESCRIPTION: Info-ZIP UnZip is vulnerable to a heap-based buffer...

Security Bulletin: Vulnerabilities in unzip affect IBM DataPower Gateways (CVE-2014-8141)

Summary IBM DataPower Gateways has addressed a vulnerability in 'unzip utility' that it uses to list, test, or extract files from a zip archive. Vulnerability Details CVEID: CVE-2014-8141 DESCRIPTION: Info-ZIP UnZip is vulnerable to a buffer overflow, caused by improper bounds checking by the...

Important Photon OS Security Update - PHSA-2018-0144

Updates of 'unzip' packages of Photon OS have been released...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2018-2.0-0052

An update of 'unzip' packages of Photon OS has been released...

Important Photon OS Security Update - PHSA-2018-0052

Updates of 'unzip' packages of Photon OS have been released...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2018-1.0-0144

An update of 'unzip' packages of Photon OS has been released...

Unsafe Unzip with spring-integration-zip

spring-integration-zip , versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So when the filename gets concatenated to...

Unsafe Unzip with spring-integration-zip

spring-integration-zip , versions prior to 1.0.1, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So when the filename gets concatenated to...

Unzip vulnerable to slip-zip attack

When extracting a ZIP file using the Unzip class, a prepared zip file could overwrite arbitrary files as the basedir wasn't enforced. All released versions starting with 1.0 are affected. The issue is addressed in release v1.8.1.6. You can modify earlier versions by implementing the changes from...

CMS Made Simple Remote Code Execution Vulnerability (CNVD-2018-08922)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A remote code execution vulnerability exists in th...