asafw

asafw 予備的な注意: これは asatools の一部として使用することをお勧めしますが、スタンドアロンでも使用できます。 asafw は、Cisco ASA ファームウェアを扱うためのスクリプト群です。gdb でのデバッグに必要なファームウェアの展開や、以下のような特定の機能を有効にするための展開/再パックを行うことができます。 起動時に gdb を有効化 デバッグを容易にするために ASLR を無効化 実際のハードウェアで使用する際に gdb で CTRL^C を可能にする Linux デバッグシェルを注入 ファームウェアの root 化通常は起動時の gdb 有効化と roo...

CVE-2025-46817

CVE-2025-46817 – Redis Lua unpack 整数オーバーフロー（潜在的なRCE） Redis Lua unpack 整数オーバーフローのPoC。8.2.1でスタックの肥大化とクラッシュを引き起こします。 概要 Redis 8.2.1には、符号付き整数を使用して結果数を計算する unpack 実装を備えたLua 5.1が同梱されています。慎重に選択された開始/終了インデックスが算術演算をラップさせ、luacheckstack...

CVE-2026-77113

Apport apport-unpack のパストラバーサル CVE-2026-77113 https://youtu.be/CdM1Xtnx0uQ Apport の apport-unpack におけるパストラバーサルの問題により、攻撃者が制御するレポートキーが、指定された展開ディレクトリの外へ逃れることが可能でした。 次の内容を含む細工されたレポート: root@kitploit: ../escaped: owned-by-report これにより、apport-unpack は、要求された宛先ディレクトリの外にあるパスへ値を書き込む可能性がありました。 影響を受けるコードパス...

PT-2026-81118

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.1.0 through 3.2.10 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description An integer overflow occurs during an int32 t multiplication within the unpack sample table function of OpenEXRCore wh...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: A integer overflow has been fixed in the rununpack function. The MFT record related to the opened file contains a runlist—an array containing information about the file’s location on the physical disk. Analysis of all...

EUVD-2026-63758

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

CVE-2026-77113

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

CVE-2026-77113 Path Traversal Vulnerability in apport-unpack

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

PT-2026-79267

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

BIT-PYTHON-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

If shutil.unpackarchive is given a ZIP archive with an absolute Windows path containing a drive C:\... then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability...

BIT-LIBPYTHON-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

If shutil.unpackarchive is given a ZIP archive with an absolute Windows path containing a drive C:\... then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the Unpack and UnpackLayer routines in archive.go and diff.go. An attacker can create or overwrite files outside the intended extraction directory by supplying a crafted archive with traversal entries or symlink...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the Unpack and UnpackLayer routines in archive.go and diff.go. An attacker can create or overwrite files outside the intended extraction directory by supplying a crafted archive with traversal entries or symlink...

CVE-2026-47699

Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make imagers::stream::unpack::unpack create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs,...

CVE-2026-17106

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...

Linux Distros Unpatched Vulnerability : CVE-2026-72457

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apparmor: fail policy unpack on accept2 allocation failure unpackpdb may need to allocate a missing ACCEPT2 table for older policy data. If that allocation...

EUVD-2026-60323

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-74238

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-72457

In the Linux kernel, the following vulnerability has been resolved: apparmor: fail policy unpack on accept2 allocation failure unpackpdb may need to allocate a missing ACCEPT2 table for older policy data. If that allocation failed, it set an error message but jumped to the success path, returning...

UBUNTU-CVE-2026-72457

In the Linux kernel, the following vulnerability has been resolved: apparmor: fail policy unpack on accept2 allocation failure unpackpdb may need to allocate a missing ACCEPT2 table for older policy data. If that allocation failed, it set an error message but jumped to the success path, returning...