Path traversal

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the filename gets concatenated to th...

CVE-2018-1261

The CVE-2018-1261 entry concerns spring-integration-zip. Affected component: spring-integration-zip prior to version 1.0.1. Vulnerability: arbitrary file write via path traversal in zip archives (including nested formats like zip, tar, 7z, etc.) when a crafted filename is concatenated to the targ...

PT-2018-11290

Name of the Vulnerable Software and Affected Versions Spring-integration-zip versions prior to 1.0.1 Description The issue allows for an arbitrary file write, which can be achieved by using a specially crafted zip archive that holds path traversal filenames. This affects not only zip archives but...

CVE-2018-1261: Improper Limitation of a Pathname to a Restricted Directory

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the filename gets concatenated to th...

libxml Denial of Service Vulnerability

libxml2 is the GNOME project team developed a C-based library for parsing XML documents, which supports multiple encoding formats, Xpath parsing, Well-formed and valid validation. A security vulnerability exists in the 'xzdecomp' function of the xzlib.c file in libxml2 version 2.9.8. A remote...

PT-2018-2476

Name of the Vulnerable Software and Affected Versions libxml2 version 2.9.8 Description The issue is related to the xz decomp function in libxml2, which can be exploited by remote attackers to cause a denial of service infinite loop via a crafted XML file, triggering LZMA MEMLIMIT ERROR. This can...

Fedora Update for mingw-xz FEDORA-2016-472cdecb18

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 24 : mingw-libarchive / mingw-xz (2016-472cdecb18)

Jun 20, 2016: libarchive 3.2.1 released This fixes a handful of security and other critical issues with 3.2.0 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it...

[SECURITY] Fedora 24 Update: mingw-xz-5.2.2-3.fc24

XZ Utils are an attempt to make LZMA compression easy to use on free as in freedom operating systems. This is achieved by providing tools and librari es which are similar to use than the equivalents of the most popular existing compression algorithms. LZMA is a general purpose compression algorit...

OracleVM 3.2 : rpm (OVMSA-2016-0077)

The remote OracleVM system is missing necessary patches to address critical security updates : - Add missing files in /usr/share/doc/ - Fix warning when applying the patch for 1163057 - Fix race condidition where unchecked data is exposed in the file system CVE-2013-64351163057 - Fix segfault on...

libxml2: DoS caused by incorrect error detection during XZ decompression

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash...

libxml2: multiple issues

CVE-2015-1819 denial of service A denial of service flaw was found in the way the libxml2 library parsed certain XML files. An attacker could provide a specially crafted XML file that, when parsed by an application using libxml2, could cause that application to use an excessive amount of memory...

FreeBSD : libxml2 -- multiple vulnerabilities (e5423caf-8fb8-11e5-918c-bcaec565249c)

reports : CVE-2015-5312 Another entity expansion issue David Drysdale. CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey David Drysdale. CVE-2015-7498 Avoid processing entities after encoding conversion failures Daniel Veillard. CVE-2015-7499 1 Add xmlHaltParser to stop the...

MGASA-2015-0433 Updated libxml2 packages fix security vulnerability

A denial of service in libxml2 when parsing a specially crafted XML file if XZ support is enabled may cause applications to hang as the parsing never terminates CVE-2015-8035...

Updated libxml2 packages fix security vulnerability

A denial of service in libxml2 when parsing a specially crafted XML file if XZ support is enabled may cause applications to hang as the parsing never terminates CVE-2015-8035...

PT-2015-2754

Name of the Vulnerable Software and Affected Versions libxml2 version 2.9.1 Description The issue is related to the xz decomp function in xzlib.c, which does not properly handle compression errors. This allows attackers to cause a denial of service, resulting in a process hang, by providing craft...

ClamAV < 0.98.7 Multiple DoS Vulnerabilities - Windows

ClamAV is prone to multiple denial of service DoS vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:clamav:clamav"...

ClamAV < 0.98.7 Multiple DoS Vulnerabilities - Linux

ClamAV is prone to multiple denial of service DoS vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:clamav:clamav"...

SUSE SLED11 / SLES11 Security Update : clamav (SUSE-SU-2014:0414-1)

The antivirus scanner ClamAV has been updated to version 0.98.1, which includes the following fixes : - Code quality fixes in libclamav, clamd, sigtool, clamav-milter, clamconf, and clamdtop. - Code quality fixes in libclamav, libclamunrar and freshclam. - bb 8385: a PDF ASCII85Decode zero-length...

SUSE SLES12 Security Update : docker (SUSE-SU-2015:0082-1)

This docker version upgrade fixes the following security and non security issues, and adds the also additional features : - Updated to 1.4.1 2014-12-15 : - Runtime : - Fix issue with volumes-from and bind mounts not being honored after create fixes bnc913213 - Added e2fsprogs as runtime dependenc...