CVE-2005-2475

Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete...

CVE-2005-2475

The provided data confirms CVE-2005-2475: a race condition in unzip allows local users to modify permissions of arbitrary files via a hard link attack during decompression. This is evidenced by multiple advisories (RHSA-2007:0203, ELSA-2007-0203, CESA-2007:0203, CESAs for RHEL/CentOS) describing ...

CVE-2005-2475

Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete...

CVE-2005-2475

Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete...

DEBIAN-CVE-2005-2475

Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete...

CVE-2005-2475

Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete...

CVE-2005-2475: Undefined Security Weakness

Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete...

unzip -- permission race vulnerability

Imran Ghory reports a vulnerability within unzip. The vulnerability is caused by a race condition between extracting an archive and changing the permissions of the extracted files. This would give an attacker enough time to remove a file and hardlink it to another file owned by the user running...

CVE-2005-0602

Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges...

DEBIAN-CVE-2005-0602

Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges...

CVE-2005-0602

Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges...

CVE-2005-0602

Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges...

CVE-2005-0602

Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges...

CVE-2005-0602

Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges...

CVE-2005-0602

CVE-2005-0602 affects unzip 5.51 and earlier, where extracting setuid/setgid files may not warn the user, enabling local privilege escalation. Multiple connected docs corroborate: Ubuntu USN-159-1 describes unzip vulnerability and remediation guidance; Mandrake MDKSA-2005:197 notes the issue and ...

CVE-2005-0602: Undefined Security Weakness

Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges...

CVE-2005-0519: Undefined Security Weakness

ArGoSoft FTP Server before 1.4.2.7 allows remote attackers to read arbitrary files by uploading a ZIP file containing a shortcut .LNK file, using SITE UNZIP to extract the .LNK file onto the server, then accessing the file, a different vulnerability than CVE-2005-0520...

CVE-2004-2674

Directory traversal vulnerability in ArGoSoft FTP Server before 1.4.1.6 allows remote authenticated users to determine the existence of arbitrary files via ".." sequences in the SITE UNZIP argument...

Debian DSA-344-2 : unzip - directory traversal

A directory traversal vulnerability in UnZip 5.50 allows attackers to bypass a check for relative pathnames '../' by placing certain invalid characters between the two '.' characters. The fix which was implemented in DSA-344-1 may not have protected against all methods of exploiting this...

Mandrake Linux Security Advisory : unzip (MDKSA-2003:073-1)

A vulnerability was discovered in unzip 5.50 and earlier that allows attackers to overwrite arbitrary files during archive extraction by placing non-printable characters between two '.' characters. These invalid characters are filtered which results in a '..' sequence. The patch applied to these...