PT-2019-20046

Name of the Vulnerable Software and Affected Versions fs-path affected versions not specified Description The issue concerns command injection due to unsanitized user input. There is no information about the estimated number of potentially affected devices or real-world incidents where this issue...

Duplicate Advisory: Command Injection in fs-git

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wp3j-gv53-4pg8. This link is maintained to preserve external references. Original Description Affected versions of fs-git do not sanitize strings passed into the buildCommand method, resulting in arbitrary code...

GHSA-QR32-J4J6-3M7R Duplicate Advisory: Command Injection in fs-git

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wp3j-gv53-4pg8. This link is maintained to preserve external references. Original Description Affected versions of fs-git do not sanitize strings passed into the buildCommand method, resulting in arbitrary code...

PT-2019-8040

Name of the Vulnerable Software and Affected Versions fs-git versions prior to 1.0.2 Description The issue arises from the lack of sanitization of strings passed into the buildCommand method, leading to arbitrary code execution. Recommendations Update to version 1.0.2 or later...

Memory Corruption

Linux kernel is vulnerable to memory corruption attacks. This occurs in the fs/timerfd.c file which allows a local user to cause a kernel list corruption or use-after-free via simultaneous operations with a file descriptor which leverage improper mightcancel queuing. An unprivileged local user...

CVE-2019-11833

fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem...

CVE-2019-11833: Use of Uninitialized Resource

fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem...

kernel security and bug fix update

2.6.32-754.14.2.OL6 - Update genkey bug 25599697 2.6.32-754.14.2 - x86 x86/speculation/mds: Add SMT warning message Waiman Long 1692386 1692387 1692388 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 - x86 x86/speculation/mds: Add mds=full, nosmt cmdline option Waiman Long 1692386 1692387 1692388...

PT-2019-4495

Name of the Vulnerable Software and Affected Versions Linux kernel version 5.0.21 Description The issue is related to a NULL pointer dereference in the f2fs recover fsync data function in the Linux kernel, specifically when mounting a crafted f2fs filesystem image. This is connected to F2FS P SB ...

Arbitrary File Overwrite

tar-fs is vulnerable to arbitrary file overwrite attacks. The attack is possible because it does not restrict the target of tarball containing hardlink from overwriting an existing file with an identical name as the hardlink, allowing arbitrary file overwrite attacks if an attacker gets control...

GHSA-X2MC-8FGJ-3WMR Improper Input Validation in tar-fs

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

@capriza/far (>=0.1.2, <=2.4.2), @cobalt-engine/cobower (2.0.0) +136 more potentially affected by CVE-2018-20835 via tar-fs (>=1.0.0, <=1.16.0)

tar-fs NPM version =1.0.0, =0.1.2, =6.0.3, =6.0.3, =6.0.3, =2.1.1, =0.10.2, =0.0.0-beta.1, =0.0.0-beta.1, =0.0.0-beta.1, =0.1.0, =0.1.0, =1.1.3, =0.0.65, =1.8.2 and more Source cves: CVE-2018-20835 Source advisory: OSV:GHSA-X2MC-8FGJ-3WMR...

Improper Input Validation in tar-fs

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

CVE-2018-20835

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

CVE-2018-20835

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

Design/Logic Flaw

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

CVE-2018-20835

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

CVE-2018-20835

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

CVE-2018-20835

CVE-2018-20835 affects tar-fs (node tar extraction library) before version 1.16.2. The vulnerability is an Arbitrary File Overwrite that occurs when extracting a tarball containing a hardlink to a file that already exists on the system, combined with a later plain file named the same as the hardl...

CVE-2018-20835

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...