picklescan 安全漏洞

picklescan is a security scanning program by the individual developer Matthieu Maitre. A security vulnerability exists in picklescan that stems from improper handling of exception conditions by the ZIP archive scanning component, which could lead to bypassing a security scan and executing malicio...

Security update for vim

This update for vim fixes the following issues: Update to version 9.1.1629. CVE-2025-53905: Fixed a path traversal issue in tar.vim plugin that may allow for file overwriting when opening specially crafted tar files bsc1246604. CVE-2025-53906: Fixed a path traversal issue in zip.vim plugin that m...

SUSE-SU-2025:03240-1 Security update for vim

This update for vim fixes the following issues: Update to version 9.1.1629. - CVE-2025-53905: Fixed a path traversal issue in tar.vim plugin that may allow for file overwriting when opening specially crafted tar files bsc1246604. - CVE-2025-53906: Fixed a path traversal issue in zip.vim plugin th...

Ubuntu 24.04 LTS / 25.04 : Vim vulnerabilities (USN-7748-1)

The remote Ubuntu 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7748-1 advisory. It was discovered that Vim incorrectly handled file extraction when opening maliciously crafted zip or tar archives. An attacker could possibly u...

EulerOS Virtualization 2.13.1 : vim (EulerOS-SA-2025-2184)

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the :redir ex command t...

EulerOS Virtualization 2.13.0 : vim (EulerOS-SA-2025-2185)

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the :redir ex command t...

USN-7748-1 vim vulnerabilities

It was discovered that Vim incorrectly handled file extraction when opening maliciously crafted zip or tar archives. An attacker could possibly use this issue to create or overwrite files on the system and execute arbitrary code...

CVE-2025-9918

A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server versions 6.3.54.0, 6.3.53.2, and all prior versions allows an authenticated attacker with permissions to import Use Cases to achieve Remote Code Execution RCE via uploading a malicious ZIP archive...

Security update for vim

This update for vim fixes the following issues: CVE-2025-53906: Fixed malicious zip archive causing path traversal bsc1246602 CVE-2025-53905: Fixed malicious tar archive causing path traversal bsc1246604 CVE-2025-55157: Fixed use-after-free in internal tuple reference management bsc1247938...

CVE-2025-9918

A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server versions 6.3.54.0, 6.3.53.2, and all prior versions allows an authenticated attacker with permissions to import Use Cases to achieve Remote Code Execution RCE via uploading a malicious ZIP archive...

CVE-2025-9918 Zip Slip in Google SecOps SOAR allows for Remote Code Execution

A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server versions 6.3.54.0, 6.3.53.2, and all prior versions allows an authenticated attacker with permissions to import Use Cases to achieve Remote Code Execution RCE via uploading a malicious ZIP archive...

CVE-2025-9918 Zip Slip in Google SecOps SOAR allows for Remote Code Execution

A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server versions 6.3.54.0, 6.3.53.2, and all prior versions allows an authenticated attacker with permissions to import Use Cases to achieve Remote Code Execution RCE via uploading a malicious ZIP archive...

CVE-2025-58755

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. The extractall function zipfile.extractalloutputdir is used directly to process compressed files. It is used in many places in the project. In versions up to and including 1.5.0, when the Zip file containing malicious...

PT-2025-37160

Name of the Vulnerable Software and Affected Versions: Google SecOps SOAR Server versions prior to 6.3.54.0 Description: A path traversal flaw exists in the archive extraction component of Google SecOps SOAR Server. This allows an authenticated attacker with Use Case import permissions to achieve...

php:8.2 security update

libzip php 8.2.28-1 - rebase to 8.2.28 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip...

CVE-2025-9918: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server versions 6.3.54.0, 6.3.53.2, and all prior versions allows an authenticated attacker with permissions to import Use Cases to achieve Remote Code Execution RCE via uploading a malicious ZIP archive...

Oracle Linux 8 : php:8.2 (ELSA-2025-15687)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-15687 advisory. libzip php 8.2.28-1 - rebase to 8.2.28 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip Tenable has extracted the preceding descripti...

Directory Traversal

Overview xml2rfc is a Xml2rfc generates RFCs and IETF drafts from document source in XML according to the IETF xml2rfc v2 and v3 vocabularies. Affected versions of this package are vulnerable to Directory Traversal via the processing of link elements with rel="attachment" in prepped RFCXML files...

Protection Mechanism Failure

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Protection Mechanism Failure when processing ZIP files. An attacker can bypass detection of malicious payloads by crafting ZIP archives with...

Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check

Summary Picklescan's ability to scan ZIP archives for malicious pickle files is compromised when the archive contains a file with a bad Cyclic Redundancy Check CRC. Instead of attempting to scan the files within the archive, whatever the CRC is, Picklescan fails in error and returns no results...