[SECURITY] Fedora 27 Update: perl-Archive-Tar-2.28-1.fc27

Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support...

Security Bulletin: Public disclosed vulnerability from Apache Commons affects IBM Spectrum LSF Explorer.

Summary Public disclosed vulnerability CVE-2018-1324 from Apache Commons affects IBM Spectrum LSF Explorer. Vulnerability Details CVE Descriptions CVEID: CVE-2018-1324 DESCRIPTION: A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field...

Security Bulletin: Unauthorized Access Vulnerability affects IBM Tivoli Storage Manager Client (CVE-2016-2894)

Summary When performing an archive and retrieve operation using a symbolic link, the IBM Tivoli Storage Manager IBM Spectrum Protect Client could allow a local user to access files they are otherwise not allowed to access. Vulnerability Details CVEID: CVE-2016-2894 DESCRIPTION: IBM Tivoli Storage...

Security Bulletin: TSM client SetUID elevation of privilege (CVE-2014-0907)

Summary A vulnerability in the IBM Tivoli Storage Manager TSM AIX and HP-UX clients could allow a local user to gain elevated privilege. Vulnerability Details CVE ID: CVE-2014-0907 DESCRIPTION: The IBM Tivoli Storage Manager TSM AIX and HP-UX client binaries have been compiled in an insecure way....

Security Bulletin: TSM client metadata local unauthorized access (CVE-2013-6335)

Summary IBM Tivoli Storage Manger TSM for Space Management files can be restored incorrectly by the TSM Backup-Archive client, potentially allowing unauthorized local access to those files. Vulnerability Details CVE ID: CVE-2013-6335 Description: The file metadata of TSM for Space Management file...

Security Bulletin: TSM Client GUI local hang (CVE-2014-0876)

Summary An IBM Tivoli Storage Manager TSM client local vulnerability can cause the crash or hang of certain Java GUI functions. Vulnerability Details CVE ID: CVE-2014-0876 Description: A local buffer overrun in the IBM Tivoli Storage Manager TSM Windows and Macintosh backup-archive client Java GU...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Perl vulnerability (USN-3684-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3684-1 advisory. It was discovered that Perl incorrectly handled certain archive files. An attacker could possibly use this to overwrite arbitrary files...

USN-3684-2: Perl vulnerability

USN-3684-1 fixed a vulnerability in perl. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that Perl incorrectly handled certain archive files. An attacker could possibly use this to overwrite arbitrary files...

USN-3684-1: Perl vulnerability

It was discovered that Perl incorrectly handled certain archive files. An attacker could possibly use this to overwrite arbitrary files...

USN-3684-1 perl vulnerability

It was discovered that Perl incorrectly handled certain archive files. An attacker could possibly use this to overwrite arbitrary files...

[SECURITY] [DSA 4227-1] plexus-archiver security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4227-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 12, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4226-1] perl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4226-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 12, 2018 https://www.debian.org/security/faq -...

Debian DSA-4226-1 : perl - security update

Jakub Wilk discovered a directory traversal flaw in the Archive::Tar module, allowing an attacker to overwrite any file writable by the extracting user via a specially crafted tar archive. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Perl Directory Traversal Vulnerability

Perl is a free and powerful cross-platform programming language developed by American programmer Larry Wall.Archive::Tar module is one of the modules used to handle tar files. A security vulnerability exists in the Archive::Tar module in Perl 5.26.2 and earlier. The vulnerability can be exploited...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview sharpziplib is a Zip, GZip, Tar and BZip2 library written entirely in C for the .NET platform. Affected versions of the package are vulnerable to Arbitrary File Write via Archive Extraction AKA "Zip Slip". It is exploited using a specially crafted zip archive, that holds path traversal...

web.archive.org XSS vulnerability

Open Bug Bounty ID: OBB-629471 Description| Value ---|--- Affected Website:| web.archive.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Directory traversal

OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames...

CVE-2018-12036

CVE-2018-12036 affects OWASP Dependency-Check prior to 3.2.0. The issue allows an attacker to write to arbitrary files by processing a crafted archive that contains directory traversal filenames, enabling arbitrary file writes. This is caused by unsafe extraction paths in the affected component. ...

DEBIAN-CVE-2018-12015

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name...

Directory traversal

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name...