PT-2025-55131

Уязвимость функции extract file архиватора GNU Tar связана с чтением за допустимыми границами буфера данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

The vulnerability of the smb_extract_folioq_to_rdma() function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the smbextractfolioqtordma function in the Linux operating system is related to the violation of the buffer boundary. Exploiting this vulnerability can allow an attacker to cause a service failure...

arfur (>=0.0.1, <=0.0.2), arfur-build (>=0.0.1, <=0.0.2) +20 more potentially affected by unknown CVE via zip-extract (>=0.1.3, <=0.2.3)

zip-extract CARGO version =0.1.3, =0.0.1, =0.0.1, =0.0.1, =0.1.3, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0172...

`zip-extract` is unmaintained; use the `zip >= 2.4.0` crate instead

The zip-extract crate has been explicitly deprecated by its author on Jul 16, 2025, and the repository was archived on Sep 8, 2025. The author added deprecation notices README stating that the functionality is now available directly in the zip crate via ZipArchive::extract available since zip 0.6...

RUSTSEC-2025-0172 `zip-extract` is unmaintained; use the `zip >= 2.4.0` crate instead

The zip-extract crate has been explicitly deprecated by its author on Jul 16, 2025, and the repository was archived on Sep 8, 2025. The author added deprecation notices README stating that the functionality is now available directly in the zip crate via ZipArchive::extract available since zip 0.6...

PT-2025-62919

The zip-extract crate has been explicitly deprecated by its author on Jul 16, 2025, and the repository was archived on Sep 8, 2025. The author added deprecation notices README stating that the functionality is now available directly in the zip crate via ZipArchive::extract available since zip 0.6...

OESA-2025-1767 erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fixes: Improper Limitation of a Pathname to a Restricted...

PT-2025-40805

Name of the Vulnerable Software and Affected Versions allegroai/clearml version v2.0.1 Description A flaw exists in the handling of symbolic and hard links within the safe extract function, leading to a path traversal issue. This can result in arbitrary file writes outside the intended directory...

cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory

A flaw was found in the Python tarfile module. This vulnerability allows attackers to bypass extraction filters, enabling symlink targets to escape the destination directory and allowing unauthorized modification of file metadata via the use of TarFile.extract or TarFile.extractall with the filte...

cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory

A flaw was found in the Python tarfile module. This vulnerability allows attackers to bypass extraction filters, enabling symlink targets to escape the destination directory and allowing unauthorized modification of file metadata via the use of TarFile.extract or TarFile.extractall with the filte...

SUSE CVE-2025-38179

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix maxsge overflow in smbextractfolioqtordma This fixes the following problem: 749.901015 T8673 run fstests cifs/001 at 2025-06-17 09:40:30 750.346409 T9870...

DEBIAN-CVE-2025-38179

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix maxsge overflow in smbextractfolioqtordma This fixes the following problem: 749.901015 T8673 run fstests cifs/001 at 2025-06-17 09:40:30 750.346409 T9870...

cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory

A flaw was found in the Python tarfile module. This vulnerability allows attackers to bypass extraction filters, enabling symlink targets to escape the destination directory and allowing unauthorized modification of file metadata via the use of TarFile.extract or TarFile.extractall with the filte...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the Extract method. An attacker can gain remote code execution by uploading specially crafted archive files containing path traversal sequences in filenames, resulting in files being written to arbitrary...

PT-2025-27954

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the version that includes the fix for the max sge overflow in smb extract folioq to rdma Description: A vulnerability has been resolved in the Linux kernel related to the max sge overflow in smb extract folioq t...

SUSE CVE-2025-4748

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Erlang OTP stdlib modules allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: btrfs: Fixed an assertion failure that occurred when splitting an ordered extent after a transaction abort. If a direct IO write transaction abort occurs, we mark all existing ordered extents with the BTRFSORDEREDIOERR flag done...

CVE-2025-4748

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Erlang OTP stdlib modules allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2,...

UBUNTU-CVE-2025-4748

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Erlang OTP stdlib modules allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2,...

EEF-CVE-2025-4748 Absolute path traversal in zip:unzip/1,2

Summary Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Erlang OTP stdlib modules allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1,...