Cybercriminals Use Eclipse Jarsigner to Deploy XLoader Malware via ZIP Archives

A malware campaign distributing the XLoader malware has been observed using the DLL side-loading technique by making use of a legitimate application associated with the Eclipse Foundation. "The legitimate application used in the attack, jarsigner, is a file created during the installation of the...

SUSE CVE-2024-57970

libarchive through 3.7.7 has a heap-based buffer over-read in headergnulonglink in archivereadsupportformattar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname...

CVE-2024-57970

libarchive through 3.7.7 has a heap-based buffer over-read in headergnulonglink in archivereadsupportformattar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname...

CVE-2024-57970

CVE-2024-57970 affects libarchive up to 3.7.7, introducing a heap-based buffer over-read in header_gnu_longlink when handling GNU long linknames within TAR archives. The root cause is improper truncation handling in the middle of a GNU long linkname, which can lead to memory read vulnerabilities ...

CVE-2024-57970

libarchive through 3.7.7 has a heap-based buffer over-read in headergnulonglink in archivereadsupportformattar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname...

CVE-2024-57970

libarchive through 3.7.7 has a heap-based buffer over-read in headergnulonglink in archivereadsupportformattar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname...

PT-2025-6764

Name of the Vulnerable Software and Affected Versions libarchive versions 3.7.7 and earlier Description The issue is a heap-based buffer over-read in the header gnu longlink function in archive read support format tar.c via a TAR archive. This occurs because the software mishandles truncation in...

CVE-2024-11343

In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 2025.1.205, unzipping an archive can lead to arbitrary file system access...

CVE-2025-0332

In Progress® Telerik® UI for WinForms, versions prior to 2025 Q1 2025.1.211, using the improper limitation of a target path can lead to decompressing an archive's content into a restricted directory...

OESA-2025-1133 ark security update

Ark is a program for managing various archive formats. Archives can be viewed, extracted, created and modified from within Ark. The program can handle various formats such as tar, gzip, bzip2, zip, rar and lha if appropriate command-line programs are installed. Security Fixes: libarchiveplugin.cp...

SUSE CVE-2023-30601

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be...

Updated ark packages fix security vulnerability

A security issue exists in Ark where a maliciously crafted archive containing file paths beginning with "/" allows files to be extracted to locations outside the intended directory...

The vulnerability of the 7Z File Parser component, a archive file processor for the WinZip archive manager, allows a hacker to execute arbitrary code.

The vulnerability of the 7Z File Parser component, a archive file processor for the WinZip archive manager, is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code in the context of the current user, by sending a...

CVE-2025-0332

In Progress® Telerik® UI for WinForms, versions prior to 2025 Q1 2025.1.211, using the improper limitation of a target path can lead to decompressing an archive's content into a restricted directory...

CVE-2025-0332

In Progress® Telerik® UI for WinForms, versions prior to 2025 Q1 2025.1.211, using the improper limitation of a target path can lead to decompressing an archive's content into a restricted directory...

CVE-2024-11343

In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 2025.1.205, unzipping an archive can lead to arbitrary file system access...

CVE-2025-0332

CVE-2025-0332 affects Progress Telerik UI for WinForms. Prior to 2025 Q1 (2025.1.211), improper limitation of a target path enables path traversal when decompressing archive contents into a restricted directory. Impact involves potential exposure/manipulation of data (confidentiality, integrity, ...

Progress Telerik UI 路径遍历漏洞

Progress Telerik UI is a suite of UI user interface controls for application development from Progress, Inc. A path traversal vulnerability exists in Progress Telerik UI prior to version 2025 Q1, which stems from the fact that the use of improper destination path restrictions could result in the...

PT-2025-6501 · Telerik · Telerik Document Processing Libraries

Name of the Vulnerable Software and Affected Versions: In Progress Telerik Document Processing Libraries versions prior to 2025.1.205 Description: The issue allows arbitrary file system access when unzipping an archive. Recommendations: For versions prior to 2025.1.205, update to version 2025.1.2...

Fedora 40 : rust-routinator (2025-46db4ee37e)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-46db4ee37e advisory. New ASPA support is now always compiled in and available if enable-aspa is set. The aspa Cargo feature has been removed. 990 If merging mutliple ASPA objects...