SUSE-SU-2022:4394-1 Security update for nautilus

This update for nautilus fixes the following issues: - CVE-2022-37290: Fixed a denial of service caused by pasted ZIP archives bsc1205418...

SUSE-SU-2022:4393-1 Security update for nautilus

This update for nautilus fixes the following issues: - CVE-2022-37290: Fixed a denial of service caused by pasted ZIP archives bsc1205418...

Medium: ant

Issue Overview: When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats...

Fedora: Security Advisory for advancecomp (FEDORA-2022-99c00af79f)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

golang: compress/gzip: stack exhaustion in Reader.Read

A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion...

NewStart CGSL MAIN 6.02 : libarchive Vulnerability (NS-SA-2022-0092)

The remote NewStart CGSL host, running version MAIN 6.02, has libarchive packages installed that are affected by a vulnerability: - readheader in archivereadsupportformatrar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read i...

PT-2022-23908 · Gnome +4 · Gnome Nautilus +4

Name of the Vulnerable Software and Affected Versions: GNOME Nautilus version 42.2 Description: The issue allows a NULL pointer dereference and get basename application crash via a pasted ZIP archive. Recommendations: For GNOME Nautilus version 42.2, consider avoiding the use of pasted ZIP archiv...

archives-finistere.fr Cross Site Scripting vulnerability OBB-3047360

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2022-5440

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description The issue is related to a security feature bypass vulnerability in the Windows Mark of the Web mechanism, which is associated with errors in security settings. This vulnerability can be...

GHSA-94RR-4JR5-9H2P Apache Ivy does not verify target path when extracting the archive

With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to version 2.5.1 doesn't verify the target path when extracting the...

Path traversal

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vect...

CVE-2022-32287 Apache UIMA prior to 3.3.1 has a path traversal vulnerability when extracting (PEAR) archives

A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the designated target directory using carefully crafted ZIP entry names. This issue affects Apache UIMA Apache UIMA version 3.3.0 and prior...

Path traversal

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traversal could result in remote code execution...

CVE-2022-41772

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traversal could result in remote code execution...

The vulnerability of Fortinet’s antivirus software for FortiOS operating systems and Fortinet FortiClient for Mac security solutions stems from a flaw in the data protection mechanism. This flaw allows attackers to circumvent security restrictions.

The vulnerability of Fortinet’s antivirus software for FortiOS and Fortinet FortiClient for Mac operating systems is related to a flaw in the data protection mechanism when processing RAR archive files. Exploiting this vulnerability allows an attacker to bypass security restrictions remotely...

PYSEC-2022-43042

The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0...

PYSEC-2022-43020

The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0...

PYSEC-2022-43042

The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0...

CVE-2022-41383

The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0...

CVE-2022-41383

The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0...