PT-2017-5767 · Apache · Apache Roller

Name of the Vulnerable Software and Affected Versions: Apache Roller versions prior to 5.0.3 Description: The issue allows attackers to conduct XML External Entity XXE attacks. XXE attacks occur when an application parses XML input that contains malicious external entities, which can lead to the...

Apache Roller Execute Arbitrary java Code Vulnerability

Apache Roller is the United States Apache Apache Software Foundation's set of feature-rich multi-user blogging platform. A security vulnerability exists in the weblog page template in Apache Roller versions 5.1 through 5.1.1. The vulnerability can be exploited by a remote attacker to execute...

CVE-2015-0249

The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...

Design/Logic Flaw

The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...

CVE-2015-0249

The CVE-2015-0249 entry concerns Apache Roller versions 5.1 through 5.1.1. The vulnerability arises in the weblog page template, where remote authenticated users with weblog admin privileges can execute arbitrary Java code via a crafted Velocity Template Language (VTL). Root cause is the unsafe h...

CVE-2015-0249

The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...

FreeBSD : file-roller -- path traversal vulnerability (ad479f89-9020-11e6-a590-14dae9d210b8)

reports : File Roller 3.5.4 through 3.20.2 was affected by a path traversal bug that could result in deleted files if a user were tricked into opening a malicious archive. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fr...

CVE-2016-7162

The gfileremovedirectory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive...

DEBIAN-CVE-2016-7162

The gfileremovedirectory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive...

CVE-2016-7162

The gfileremovedirectory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive...

Design/Logic Flaw

The gfileremovedirectory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive...

CVE-2016-7162

The gfileremovedirectory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive...

CVE-2016-7162

The gfileremovedirectory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive...

CVE-2016-7162

The CVE-2016-7162 vulnerability affects GNOME File Roller, where the _g_file_remove_directory function in file-utils.c can be misused to delete arbitrary files via a symlink attack on a folder inside an archive. Affected versions are File Roller 3.5.4 through 3.20.2. The exploitation context is a...

MGASA-2016-0313 Updated file-roller packages fix security vulnerability

It was discovered that File Roller incorrectly handled symlinks. If a user were tricked into extracting a specially-crafted archive, an attacker could delete files outside of the extraction directory...

Updated file-roller packages fix security vulnerability

It was discovered that File Roller incorrectly handled symlinks. If a user were tricked into extracting a specially-crafted archive, an attacker could delete files outside of the extraction directory...

openSUSE Security Update : file-roller (openSUSE-2016-1097)

This update for file-roller fixes the following issue : - CVE-2016-7162: Do not follow symlinks when deleting a folder recursively. boo997822, bgo698554 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Securit...

file-roller: multiple issues

File Roller was affected by a directory traversal bug that could result in deleted files if a user were tricked into opening a malicious archive...

Ubuntu: Security Advisory (USN-3074-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

File Roller 'src/file-utils.c' Directory Traversal Vulnerability

File Roller is for the Gnome desktop environment provides a graphical interface to operate the compressed, archived files, similar to the KDE desktop environment, Ark. A target traversal vulnerability exists in File Roller 3.5.4-3.20.2. If the target user opens a malicious document, it can cause...