ROS-2-1506

2.1506 Apache Ant utility vulnerability CVE-2021-36374, CVE-2021-36373 1. Vulnerability Description: CVE-2021-36374 A vulnerability in the Apache Ant utility, is related to the application improperly controlling internal resource consumption when processing ZIP archives. Exploitation of the...

ROS-2-537

2.537 Apache Ant utility vulnerability CVE-2021-36374, CVE-2021-36373 1. Vulnerability Description: CVE-2021-36374 A vulnerability in the Apache Ant utility, is related to the application improperly controlling internal resource consumption when processing ZIP archives. Exploitation of the...

ROS-2-951

2.951 Apache Ant utility vulnerability CVE-2021-36374, CVE-2021-36373 1. Vulnerability Description: CVE-2021-36374 A vulnerability in the Apache Ant utility, is related to the application improperly controlling internal resource consumption when processing ZIP archives. Exploitation of the...

CVE-2021-33599

A vulnerability affecting F-Secure Antivirus engine was discovered whereby scanning WIM archive file can lead to denial-of-service infinite loop and freezes AV engine scanner. The vulnerability can be exploit remotely by an attacker. A successful attack will result in Denial-of-Service of the...

SUSE: Security Advisory (SUSE-SU-2021:2834-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Apache Commons Compress library, related to the allocation of unlimited memory, allows attackers to cause a service failure.

The vulnerability of the Apache Commons Compress library is related to the allocation of unlimited memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by using specially created TAR format files...

CVE-2021-32588

A use of hard-coded credentials CWE-798 vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may allow a remote and unauthenticated attacker to execute unauthorized commands as root by uploading and deploying malicious web application...

CVE-2020-23172

A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to improper validation of file paths in .zip archives...

go-unarr directory traversal vulnerability

go-unarr is an open source go language library for decompressing RAR, TAR, ZIP and 7z archives. go-unarr version 0.1.1 is vulnerable to a directory traversal vulnerability that could be exploited to write arbitrary files on the system via specially crafted TAR archives...

openSUSE 15 Security Update : fastjar (openSUSE-SU-2021:1107-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:1107-1 advisory. - Absolute path traversal vulnerability in the extractjar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite...

go-unarr 路径遍历漏洞

go-unarr is an open source go language library for decompressing RAR, TAR, ZIP and 7z archives. go-unarr version 0.1.1 is vulnerable to a directory traversal vulnerability that could be exploited to write arbitrary files on the system via specially crafted TAR archives...

PT-2021-22005 · Go-Unarr · Go-Unarr

Name of the Vulnerable Software and Affected Versions: go-unarr versions 0.1.1 Description: The issue allows Directory Traversal via ../ in a pathname within a TAR archive. This is possible due to a flaw in the unarr.go file in go-unarr. Recommendations: For go-unarr version 0.1.1, consider...

GHSA-Q5R4-CFPX-H6FH Improper Handling of Length Parameter Inconsistency in Apache Ant

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected...

GHSA-CRV7-7245-F45F Improper Handling of Length Parameter Inconsistency in Compress

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package...

USN-5027-1 php-pear vulnerability

It was discovered that PEAR incorrectly handled symbolic links in archives. A remote attacker could possibly use this issue to execute arbitrary code...

USN-5027-1: PEAR vulnerability

It was discovered that PEAR incorrectly handled symbolic links in archives. A remote attacker could possibly use this issue to execute arbitrary code...

OESA-2021-1277 ant security update

Ant is a Java based build tool. In theory it is kind of like "make" without makes wrinkles and with the full portability of pure java code. Security Fixes: When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out...

DRUPAL-CORE-2021-004

The Drupal project uses the pear Archive\Tar library, which has released a security update that impacts Drupal. The vulnerability is mitigated by the fact that Drupal core's use of the Archive\Tar library is not vulnerable, as it does not permit symlinks. Exploitation may be possible if contrib o...

Apache Ant ZIP and ZIP based archive denial of service vulerability

...

CVE-2021-33211

A Directory Traversal vulnerability in the Unzip feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to write files to arbitrary directories via relative paths in ZIP archives...