CVE-2018-20482

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service infinite read loop in sparsedumpregion in sparse.c by modifying a file that is supposed to be archived by a different user's process e.g., a system back...

CVE-2018-20482

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service infinite read loop in sparsedumpregion in sparse.c by modifying a file that is supposed to be archived by a different user's process e.g., a system back...

CVE-2018-20482

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service infinite read loop in sparsedumpregion in sparse.c by modifying a file that is supposed to be archived by a different user's process e.g., a system back...

CVE-2018-20482

CVE-2018-20482 affects GNU tar: when using --sparse, tar can enter an infinite read loop during file shrinkage, enabling a local attacker to cause a denial of service by modifying a file being archived by another user. Affected until upstream tar versions prior to the fix; remediation is to upgra...

SUSE SLES11 Security Update : amanda (SUSE-SU-2018:4121-1)

This update for amanda fixes the following issues : Security issue fixed : CVE-2016-10729: Fixed a local privilege escalation from amanda to root via unsafe tar command options bsc1112916. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

Perl Modules Detection (Linux/Unix SSH Login)

SSH login-based detection of various installed Perl modules. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can...

rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can...

rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can...

freetype2/type1-tar: Heap-buffer-overflow in next_field

Detailed report: https://oss-fuzz.com/testcase?key=5649990777569280 Project: freetype2 Fuzzer: libFuzzerfreetype2type1-tar Fuzz target binary: type1-tar Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x61f000000e7f Crash State: nextfield...

[SECURITY] Fedora 28 Update: libarchive-3.3.3-1.fc28

Libarchive is a programming library that can create and read several differ ent streaming archive formats, including most popular tar variants, several cpio formats, and both BSD and GNU ar variants. It can also write shar archives and read ISO9660 CDROM images and ZIP archives...

GitLab: Exfiltrate and mutate repository and project data through injected templated service

The GitLab import feature contains a vulnerability that allows an attacker to import a project that creates a service template. Service templates can normally only be created by a GitLab instance Administrator. When a new project is created, service templates are automatically initialized for the...

Security update for amanda (moderate)

This update for amanda fixes the following security issue: - CVE-2016-10729: Local privilege escalation from amanda user to root via unsafe tar command options bsc1112916...

[SECURITY] Fedora 29 Update: libarchive-3.3.3-1.fc29

Libarchive is a programming library that can create and read several differ ent streaming archive formats, including most popular tar variants, several cpio formats, and both BSD and GNU ar variants. It can also write shar archives and read ISO9660 CDROM images and ZIP archives...

Open Build Service Input Validation Vulnerability

Open Build Service OBS is a general purpose system for building and distributing software packages from source code in an automated, consistent and repeatable manner. Open Build Service 51a17c553b6ae2598820b7a90fd0c11502a49106 An input validation vulnerability exists in previous versions of...

GHSA-M9JM-RHRM-GCXJ Path traversal in org.springframework.integration:spring-integration-zip

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the filename gets concatenated to th...

Path traversal in org.springframework.integration:spring-integration-zip

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the filename gets concatenated to th...

Perl Archive Tar Arbitrary File Overwrite (CVE-2018-12015)

An arbitrary file overwrite vulnerability exists in the Perl Tar Archive module. The vulnerability is due to improper handling of a tar archive. Successful exploitation could result in arbitrary file overwrite in the target user's system...

EulerOS 2.0 SP2 : perl (EulerOS-SA-2018-1307)

According to the version of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that the Archive::Tar module did not properly sanitize symbolic links when extracting tar archives. An attacker, able to provide a...

Wildpwn - Unix Wildcard Attack Tool

Wildpwn is a Python UNIX wildcard attack tool that helps you generate attacks, based on a paper by Leon Juranic. It’s considered a fairly old-skool attack vector, but it still works quite often. First things first! Read: https://www.exploit-db.com/papers/33930/ Basic usage It goes something like...