Apache Hadoop Arbitrary File Write Vulnerability

Apache Hadoop is the U.S. Apache Apache Software Foundation's set of open source distributed systems infrastructure, it can be distributed processing of large amounts of data, and has high reliability, high scalability, high fault tolerance and other characteristics. An arbitrary file write...

RHEL 7 : zziplib (RHSA-2018:3229)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3229 advisory. The zziplib is a lightweight library to easily extract data from zip files. Security Fixes: zziplib: out of bound read in...

zziplib: Memory leak in memdisk.c:zzip_mem_disk_new() can lead to denial of service via crafted zip

A memory leak was found in unzip-mem.c and unzzip-mem.c of ZZIPlib, up to v0.13.68, that could lead to resource exhaustion. Local attackers could leverage this vulnerability to cause a denial of service via a crafted zip file...

zziplib: out of bound read in mmapped.c:zzip_disk_fread() causes crash

An out of bounds read was found in function zzipdiskfread of ZZIPlib, up to 0.13.68, when ZZIPlib memdisk functionality is used. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file...

zziplib: Bus error in zip.c:__zzip_parse_root_directory() cause crash via crafted zip file

An improper input validation was found in function zzipfetchdisktrailer of ZZIPlib, up to 0.13.68, that could lead to a crash in zzipparserootdirectory function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file...

DEBIAN-CVE-2018-18384

Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12...

Buffer overflow

Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12...

Design/Logic Flaw

When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite...

The vulnerability of the extractDir function in the Zip4j library, which allows a hacker to execute arbitrary code.

The vulnerability of the extractDir function in the Zip4j library, which is used for working with zip files, is related to an incorrect limitation on the path name of the directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code using a...

mholt/archiver golang package directory traversal vulnerability

The mholt/archiver golang package is a package for compression/uncompression. A directory traversal vulnerability exists in versions prior to mholt/archiver golang package e4ef56d48eb029648b0e895bb0b6a393ef0829c3, which can be exploited to write arbitrary files with the help of a specially crafte...

DEBIAN-CVE-2015-9261

huftbuild in archival/libarchive/decompressgunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file...

Null pointer dereference

huftbuild in archival/libarchive/decompressgunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file...

UBUNTU-CVE-2015-9261

huftbuild in archival/libarchive/decompressgunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file...

plexus-archiver directory traversal vulnerability

plexus-archiver is a library for compression/decompression. A directory traversal vulnerability exists in plexus-archiver versions prior to 3.6.0. An attacker can exploit this vulnerability by writing to a file with a specially crafted zip archive file with a directory traversal name...

QuaZIP Directory Traversal Vulnerability

QuaZIP is a C++ wrapper for accessing ZIP archives. A directory traversal vulnerability exists in QuaZIP versions prior to 0.7.6. The vulnerability can be exploited to write arbitrary files with the help of a specially crafted zip archive file with a directory traversal name...

plexus security update

CentOS Errata and Security Advisory CESA-2018:1836 An update for plexus-archiver is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

CVE-2018-1261

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the filename gets concatenated to th...

ZZIPlib Bus Error Vulnerability

ZZIPlib is a lightweight used to extract files from the ZIP file to read the C language package , but also can be used to compress multiple files into zip format . A bus error vulnerability exists in the zzipparserootdirectory function in zip.c in ZZIPlib 0.13.68. An attacker could cause a denial...

Design/Logic Flaw

An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the zzipparserootdirectory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file...

CVE-2018-7726

CVE-2018-7726 affects ZZIPlib up to version 0.13.68. The issue is a bus error in __zzip_parse_root_directory (zip.c) that could crash a target via a crafted ZIP file, enabling a denial of service. Connected advisories confirm upstream fixed in 0.13.69; multiple OS advisories/patches reference thi...