PT-2025-10575

Name of the Vulnerable Software and Affected Versions PickleScan versions prior to 0.0.23 Description The issue allows an attacker to embed malicious pickle files inside PyTorch model archives by modifying specific ZIP file flag bits. This can lead to arbitrary code execution when loading a...

PT-2025-10574

Name of the Vulnerable Software and Affected Versions PickleScan versions prior to 0.0.23 Description The issue allows for a ZIP archive manipulation attack, causing PickleScan to crash when extracting and scanning PyTorch model archives. An attacker can modify the filename in the ZIP header, whi...

Picklescan data falsification vulnerability

picklescan is a security scanning program by the individual developer Matthieu Maitre. A data forgery issue vulnerability exists in picklescan versions prior to 0.0.23, which stems from a ZIP file manipulation that may cause a crash, thereby bypassing malicious payload detection...

CVE-2025-1945: Insufficient Verification of Data Authenticity

picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being...

CVE-2025-1944: Insufficient Verification of Data Authenticity

picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP header while keeping the original filename in the directory listing, an attacker can make PickleScan...

Linux Distros Unpatched Vulnerability : CVE-2023-40481

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - 7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...

Linux Distros Unpatched Vulnerability : CVE-2023-31102

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive. CVE-2023-31102 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2024-24789

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be...

Linux Distros Unpatched Vulnerability : CVE-2023-52169

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 for 7zz contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The...

Safearchive Library Uncontrolled Search Path Privilege Escalation

The vulnerability of the Safearchive library for processing tar and zip archives is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow attackers to enhance their privileges...

Linux Distros Unpatched Vulnerability : CVE-2024-11612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - 7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected...

Linux Distros Unpatched Vulnerability : CVE-2024-0450

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to...

Linux Distros Unpatched Vulnerability : CVE-2021-36090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for ver...

CLSA-2025-1741126677 python3.11: Fix of 3 CVEs

CVE-2024-4032: update 'ipaddress' module to correct isprivate and isglobal properties based on latest IANA information - CVE-2024-6923: properly quote newlines for email headers to prevent header injection - CVE-2024-8088: fix issue causing infinite loop when iterating over names of entries in a...

CVE-2025-1936

jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension...

CVE-2025-1936

jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension...

DEBIAN-CVE-2025-1936

jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension...

UBUNTU-CVE-2025-1936

jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension...

CVE-2025-1936 Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents

jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension...

CVE-2025-1936

The Mozilla Firefox and Thunderbird applications are vulnerable to a flaw where jar: URLs retrieve local file content from ZIP archives improperly. Specifically, the system ignores the null character and subsequent content when retrieving data, but uses the fake extension following the null chara...