Directory traversal

Mate 9 smartphones with software MHA-AL00AC00B125 have a directory traversal vulnerability in Push module. Since the system does not verify the file name during decompression, system directories are traversed. It could be exploited to cause the attacker to replace files and impact the service...

CVE-2017-2693

CVE-2017-2693 is a path traversal vulnerability affecting Huawei EMUI prior to certain fixes, enabling an attacker to decompress malicious files to a target path during unzip operations. The CVE entry is corroborated across sources (NVD, CNVD, CVE listing) with Huawei EMUI versions impacted (as l...

SWFTools Denial of Service Vulnerability (CNVD-2017-36375)

SWFTools is a utility toolset for working with Adobe Flash files SWF files. A security vulnerability in the lib/modules/swfbits.c file 'swfDefineLosslessBitsTagToImage' function in SWFTools version 0.9.2 stems from the program failing to properly handle decompression failures. A remote attacker...

Debian DSA-4013-1 : openjpeg2 - security update

Multiple vulnerabilities in OpenJPEG, a JPEG 2000 image compression / decompression library, may result in denial of service or the execution of arbitrary code if a malformed JPEG 2000 file is processed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks ...

Debian: Security Advisory (DSA-4013-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2017-15873

The getnextblock function in archival/libarchive/decompressbunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation...

Libarchive Rar RestartModel Code Execution Vulnerability(CVE-2016-4302)

SUMMARY An exploitable heap overflow vulnerability exists in the Rar decompression functionality of libarchive. A specially crafted Rar file can cause a heap corruption eventually leading to code execution. An attacker can send a malformed file to trigger this vulnerability. TESTED VERSIONS...

[SECURITY] Fedora 25 Update: upx-3.94-1.fc25

UPX is a free, portable, extendable, high-performance executable packer for several different executable formats. It achieves an excellent compression ratio and offers very fast decompression. Your executables suffer no memory overhead or other drawbacks...

[SECURITY] Fedora 27 Update: upx-3.94-1.fc27

UPX is a free, portable, extendable, high-performance executable packer for several different executable formats. It achieves an excellent compression ratio and offers very fast decompression. Your executables suffer no memory overhead or other drawbacks...

[SECURITY] Fedora 25 Update: libmspack-0.6-0.1.alpha.fc25

The purpose of libmspack is to provide both compression and decompression of some loosely related file formats used by Microsoft...

[SECURITY] Fedora 27 Update: libmspack-0.6-0.1.alpha.fc27

The purpose of libmspack is to provide both compression and decompression of some loosely related file formats used by Microsoft...

[SECURITY] Fedora 26 Update: libmspack-0.6-0.1.alpha.fc26

The purpose of libmspack is to provide both compression and decompression of some loosely related file formats used by Microsoft...

Iceni Argus PDF Inflate+LZW Decompression Heap-Based Buffer Overflow Vulnerability(CVE-2016-8387)

Summary An exploitable heap-based buffer overflow exists in Iceni Argus. When it attempts to convert a malformed PDF with an object encoded w/ multiple encoding types terminating with an LZW encoded type, an overflow may occur due to a lack of bounds checking by the LZW decoder. This can lead to...

The vulnerability of the VMSF_DELTA memory component of the UnRAR file decompression tool and the Sophos Anti-Virus antivirus protection allows a perpetrator to execute arbitrary code.

The vulnerability of the VMSFDELTA component, a file decompression tool, and the UnRAR decompression tool is caused by a numerical overflow. This occurs when the variable MemDestPos exceeds its allowable limits due to the negative value of the argument DestPos during the summation of DataSize and...

unrar directory traversal vulnerability

unrar also known as unrar-free or unrar-gpl is a decompression software used in Linux. A directory traversal vulnerability exists in unrar version 0.0.1. An attacker can exploit this vulnerability to decompress RAR v2 archives into an upper level directory...

CVE-2017-11235

Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in the image conversion engine when decompressing JPEG data. Successful exploitation could lead to arbitrary code...

CVE-2017-11235: Use After Free

Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in the image conversion engine when decompressing JPEG data. Successful exploitation could lead to arbitrary code...

graphite2: heap-buffer-overflow write "lz4::decompress" (src/Decompressor)

A heap-based buffer overflow flaw related to "lz4::decompress" src/Decompressor has been reported in graphite2. An attacker could exploit this issue to cause a crash or, possibly, execute arbitrary code...

graphite2: heap-buffer-overflow write "lz4::decompress" (CVE-2017-7772)

A heap-based buffer overflow flaw related to "lz4::decompress" has been reported in graphite2. An attacker could exploit this issue to cause a crash or, possibly, execute arbitrary code...

graphite2: heap-buffer-overflow write "lz4::decompress" (CVE-2017-7772)

A heap-based buffer overflow flaw related to "lz4::decompress" has been reported in graphite2. An attacker could exploit this issue to cause a crash or, possibly, execute arbitrary code...