EulerOS Virtualization 2.5.3 : perl (EulerOS-SA-2019-1158)

According to the version of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - It was found that the Archive::Tar module did not properly sanitize symbolic links when extracting tar archives. An attacker, able to...

FreeBSD : clamav -- multiple vulnerabilities (84ce26c3-5769-11e9-abd6-001b217b3468)

Clamav reports : An out-of-bounds heap read condition may occur when scanning PDF documents An out-of-bounds heap read condition may occur when scanning PE files An out-of-bounds heap write condition may occur when scanning OLE2 files An out-of-bounds heap read condition may occur when scanning...

Fedora Update for libarchive FEDORA-2019-c595a93536

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2019-0191

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This...

Ubuntu: Security Advisory (USN-3935-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3935-1: BusyBox vulnerabilities

Tyler Hicks discovered that BusyBox incorrectly handled symlinks inside tar archives. If a user or automated system were tricked into processing a specially crafted tar archive, a remote attacker could overwrite arbitrary files outside of the current directory. This issue only affected Ubuntu 14....

[SECURITY] Fedora 30 Update: libarchive-3.3.3-6.fc30

Libarchive is a programming library that can create and read several differ ent streaming archive formats, including most popular tar variants, several cpio formats, and both BSD and GNU ar variants. It can also write shar archives and read ISO9660 CDROM images and ZIP archives...

[SECURITY] Fedora 30 Update: libzip-1.5.2-1.fc30

libzip is a C library for reading, creating, and modifying zip archives. Fi les can be added from data buffers, files, or compressed data copied directly f rom other zip archives. Changes made without closing the archive can be reverte d. The API is documented by man pages...

clamav -- multiple vulnerabilities

Clamav reports: An out-of-bounds heap read condition may occur when scanning PDF documents An out-of-bounds heap read condition may occur when scanning PE files An out-of-bounds heap write condition may occur when scanning OLE2 files An out-of-bounds heap read condition may occur when scanning...

openSUSE Security Update : unzip (openSUSE-2019-509)

This update for unzip fixes the following issues : - CVE-2014-9636: Prevent denial of service out-of-bounds read or write and crash via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression bsc914442 -...

openSUSE Security Update : libarchive (openSUSE-2019-888)

This update for libarchive fixes the following issues : - CVE-2017-14501: An out-of-bounds read flaw existed in parsefileinfo in archivereadsupportformatiso9660.c when extracting a specially crafted iso9660 iso file, related to archivereadformatiso9660readheader. bsc1059139 - CVE-2017-14502:...

GHSA-869J-5855-HJPM Moderate severity vulnerability that affects org.apache.karaf:apache-karaf and org.apache.karaf:karaf

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This...

[SECURITY] Fedora 29 Update: libarchive-3.3.3-6.fc29

Libarchive is a programming library that can create and read several differ ent streaming archive formats, including most popular tar variants, several cpio formats, and both BSD and GNU ar variants. It can also write shar archives and read ISO9660 CDROM images and ZIP archives...

Fedora 29 : libzip (2019-615e060d4e)

Version 1.5.2 - Fix bug in AES encryption affecting certain file sizes - Keep file permissions when modifying zip archives - Support systems with small stack size. - Add nullability annotations. Note that Tenable Network Security has extracted the preceding description block directly from the...

Ubuntu 16.04 LTS : P7ZIP vulnerabilities (USN-3913-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3913-1 advisory. It was discovered that p7zip did not correctly handle certain malformed archives. If a user or automated system were tricked into processing a specially...

CVE-2019-9923

paxdecodeheader in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers...

CVE-2019-9923

paxdecodeheader in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers...

CVE-2019-9923

paxdecodeheader in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers...

[SECURITY] Fedora 28 Update: libzip-1.5.2-1.fc28

libzip is a C library for reading, creating, and modifying zip archives. Fi les can be added from data buffers, files, or compressed data copied directly f rom other zip archives. Changes made without closing the archive can be reverte d. The API is documented by man pages...

USN-3913-1: P7ZIP vulnerabilities

It was discovered that p7zip did not correctly handle certain malformed archives. If a user or automated system were tricked into processing a specially crafted archive with p7zip, then p7zip could be made to crash, possibly leading to abitrary code execution...