CVE-2013-4668

Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to...

DEBIAN-CVE-2013-4668

Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to...

Directory traversal

Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to...

CVE-2013-4668

Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to...

CVE-2013-4668

Summary (CVE-2013-4668): Directory traversal in GNOME File Roller when using libarchive, affecting 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, enables remote creation of arbitrary files via crafted archives that mishandle “Keep directory structure” paths. Root cause noted in f...

CVE-2013-4668

Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to...

Ubuntu 12.10 / 13.04 : file-roller vulnerability (USN-1906-1)

Yorick Koster discovered that File Roller incorrectly sanitized paths. If a user were tricked into extracting a specially crafted archive, an attacker could create and overwrite files outside of the extraction directory. Note that Tenable Network Security has extracted the preceding description...

USN-1906-1: File Roller vulnerability

Yorick Koster discovered that File Roller incorrectly sanitized paths. If a user were tricked into extracting a specially-crafted archive, an attacker could create and overwrite files outside of the extraction directory...

[SECURITY] Fedora 19 Update: file-roller-3.8.3-1.fc19

File Roller is an application for creating and viewing archives files, such as tar or zip files...

Fedora 19 : file-roller-3.8.3-1.fc19 (2013-12667)

This update fixes CVE-2013-4668 : The File Roller archive manager for the GNOME desktop suffers from a path traversal vulnerability caused by insufficient path sanitization. A specially crafted archive file can be used to trigger creation of arbitrary files in any location, writable by the user...

Gnome File Roller directory traversal

Directory traversal on archive processing...

[oCERT-2013-001] File Roller path sanitization errors

2013-001 File Roller path sanitization errors Description: The File Roller archive manager for the GNOME desktop suffers from a path traversal vulnerability caused by insufficient path sanitization. A specially crafted archive file can be used to trigger creation of arbitrary files in any locatio...

CVE-2013-4668

Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to...

Operation High Roller Now Targets Europe's SEPA Network and Large US Bank

The criminals behind Operation High Roller, a complex wire-fraud scheme that has scammed high-end banking customers out of millions, have added a new dimension of automation to their attacks and expanded their efforts beyond Europe and have targeted a major U.S. bank. Researchers at McAfee provid...

CVE-2012-2381: Apache Roller Cross-Site-Scripting (XSS) vulnerability

Severity: important Vendor: The Apache Software Foundation Versions Affected: Roller 4.0.0 to Roller 4.0.1 Roller 5.0 The unsupported Roller 3.1 release is also affected Description: Roller trusts bloggers to post HTML and JavaScript code in the weblog and for some sites this can be a problem...

CVE-2012-2380: Apache Roller Cross-Site-Resource-Forgery (XSRF) vulnerability

Severity: important Vendor: The Apache Software Foundation Versions Affected: Roller 4.0.0 to Roller 4.0.1 Roller 5.0 The unsupported Roller 3.1 release is also affected Description: HTTP POST interfaces in the Roller admin/editor console were not protected from CSRF attacks. This issue has been...

Three Baltic Men Jailed After Using SpyEye Malware

Two men found using the SpyEye Trojan to swindle users out of their banking information were jailed last week after violating the United Kingdom’s Computer Misuse Act. Pavel Cyganok, 28, a Lithuanian, along with Ilja Zakrevski, 26, an Estonian, were jailed for four years while a third man, Latvia...

New Fraud Ring 'Operation High Roller' Targets the Rich

A recent fraud ring through which attackers raided high-value bank accounts, nicknamed Operation High Roller .PDF, employed attacks that were quick, required no human interaction and have already affected several tiers of credit unions, regional banks and large global banks, over the last several...

CVE-2012-2381

Multiple cross-site scripting XSS vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role...

CVE-2012-2380

Multiple cross-site request forgery CSRF vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by leveraging the HTTP POST functionality...