unzip directory traversal revisited

unzip directory traversal revisited problem: well I kinda stumbled over this when i was looking for something else A while back some fuss was made over the use of .. sequences in archives because it allows you to craft an archive which will trojan your system on extraction the creators of unzip...

CVE-2002-0761

CVE-2002-0761 affects bzip2 before 1.0.2 on FreeBSD (4.5 and earlier) and OpenLinux (3.1 and 3.1.1). The issue arises when creating an archive: bzip2 honors the permissions of the symbolic link rather than those of the target file, which could cause files to be extracted with less restrictive per...

Multiple glftpd bugs

Directory traversal in messaging system, archive extraction, effective uid problem...

Symantec Norton Antivirus bufffer overflow

Buffer overflow on oversized filename inside archive...

XSS (Cross Site Scripting) on FormMail.CGI

Topic: XSS Cross Site Scripting on FormMail.CGI Version: 1.92 Released: April 21, 2002 Manufacturer: http://www.scriptarchive.com/formmail.html By XyborG - [email protected] - http://www.rzweb.com.ar/ Formmai.cgi, it is a utility that serves to send forms by email, among other uses. The operatio...

CVE-2002-1388

Cross-site scripting XSS vulnerability in MHonArc before 2.5.14 allows remote attackers to inject arbitrary HTML into web archive pages via HTML mail messages...

PT-2002-2518 · Hewlett Packard · Chaivm Ezloader

Name of the Vulnerable Software and Affected Versions: ChaiVM EZloader for HP color LaserJet 4500 and 4550 and HP LaserJet 4100 and 8150 affected versions not specified Description: The issue is related to the improper verification of JAR signatures for new services in ChaiVM EZloader. This allow...

[SECURITY] [DSA NONE] New security.debian.org server after fire in Twente

-------------------------------------------------------------------------- Debian Security Announcement [email protected] http://www.debian.org/security/ Martin Schulze November 22nd, 2002 http://www.debian.org/security/faq -...

[SECURITY] [DSA NONE] New security.debian.org server after fire in Twente

-------------------------------------------------------------------------- Debian Security Announcement [email protected] http://www.debian.org/security/ Martin Schulze November 22nd, 2002 http://www.debian.org/security/faq -...

Buffer overflow and directory traversal in Microsoft Windows Compressed Folders feature

Buffer overflow and directory traversal while extracting file from .zip archive...

Low: Red Hat Security Advisory: unzip security update

The unzip and tar utilities contain vulnerabilities which can allow arbitrary files to be overwritten during archive extraction. updated Jan 22 2003 Added description of CAN-2002-1216 which was also fixed by these erratum packages. The unzip and tar utilities are used for dealing with archives,...

ZIP archives containing files with large filenames can cause buffer overflows

Overview Multiple file decompression utilities contain buffer overflow vulnerabilities for which the impacts vary. Description Researchers at Rapid7, Inc. have discovered that multiple file decompression utilities are susceptible to buffer overflows as a result of large filenames embedded in...

CVE-2002-0399

CVE-2007-4559 is a directory traversal vulnerability in the tarfile module of Python, allowing a tar archive containing a .. sequence to overwrite arbitrary files during extraction. The issue is referenced in multiple Nessus advisories (e.g., Alibaba Cloud Linux 3 advisory ALINUX3-SA-2024:0040 an...

CVE-2002-0399

Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a 1 "/.." or 2 "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267...

Macromedia Flash plugin can read local files

.---. .---------- / / ------ / / / ----- ////// ' / --- //// / // : : --- // / / / '-- // //.. ====UU====UU==== '//|| Macromedia Flash plugin can read local files Description : Macromedia Flash Player is the leading rich client for Internet content and applications across the broadest range of...

CVE-2001-1271

Directory traversal vulnerability in rar 2.02 and earlier allows attackers to overwrite arbitrary files during archive extraction via a .. dot dot attack on archived filenames...

CVE-2001-1271

Technical details beyond the provided description are not available in the connected documents; CVE-2001-1271 describes a directory traversal in rar 2.02 and earlier via .. in archived filenames, with no further details in the supplied sources.

CVE-2001-1270

Directory traversal vulnerability in the console version of PKZip pkzipc 4.00 and earlier allows attackers to overwrite arbitrary files during archive extraction with the -rec recursive option via a .. dot dot attack on the archived files...

CVE-2001-1271

Directory traversal vulnerability in rar 2.02 and earlier allows attackers to overwrite arbitrary files during archive extraction via a .. dot dot attack on archived filenames...

CVE-2001-1269

Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via filenames in the archive that begin with the '/' slash character...