6 matches found
CVE-2026-71284 Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename
Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...
Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection
Cybersecurity researchers have shed light on a novel attack chain that employs phishing emails to deliver an open-source backdoor called VShell. The "Linux-specific malware infection chain that starts with a spam email with a malicious RAR archive file," Trellix researcher Sagar Bade said in a...
CVE-2017-11190
unrarlib.c in unrar-free 0.0.1, when DEBUGLOG mode is enabled, might allow remote attackers to cause a denial of service stack-based buffer overflow and application crash or possibly have unspecified other impact via an RAR archive containing a long filename...
Design/Logic Flaw
cbrPager before 0.9.17 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a 1 ZIP aka .cbz or 2 RAR aka .cbr archive filename...
CVE-2008-2575
CVE-2008-2575 affects the cbrPager utility. The vulnerability allows user-assisted remote code execution via shell metacharacters in archive filenames for image archives (ZIP/.cbz and RAR/.cbr). Affected version: cbrPager before 0.9.17. The issue arises from filenames being passed to decompressio...
