6166 matches found
Node.js -- August 2021 Security Releases (2)
Node.js reports: npm 6 update - node-tar, arborist, npm cli modules These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804. Subsequent internal...
CVE-2021-37701
The npm package "tar" aka node-tar before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieve...
node-tar 后置链接漏洞
node-tar is a software package for file compression/decompression. A backlink vulnerability exists in Node-tar, which stems from the product not validating special characters. An attacker can use this vulnerability to create malicious files in other paths...
CVE-2021-37701
CVE-2021-37701 (node-tar) affects the tar handling in node-tar where symlink-based directory cache poisoning enables arbitrary file creation/overwrite during extraction. The vulnerability arises from insufficient protection when an archive contains a directory followed by a symlink that shares th...
CVE-2021-37701
The npm package "tar" aka node-tar before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieve...
nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite
The npm package "tar" aka node-tar has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted...
nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite
The npm package "tar" aka node-tar has an arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This i...
nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite
The npm package "tar" aka node-tar has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted...
nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite
The npm package "tar" aka node-tar has an arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This i...
RHEL 7 : rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon (RHSA-2021:3281)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3281 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...
async_docker (>=0.1.0, <=0.1.1), cargo (>=0.4.0, <=0.8.0) +11 more potentially affected by CVE-2021-38511 via tar (>=0.2.14, <=0.3.4)
tar CARGO version =0.2.14, =0.1.0, =0.4.0, =0.3.1, =0.1.0, =0.3.0, =0.2.0, =0.2.0, =0.2.1, =0.0.1, =0.0.9 - wormhole 0.1.0 Source cves: CVE-2021-38511 Source advisory: OSV:GHSA-62JX-8VMH-4MCW...
Arbitrary file overwrite in tar-rs
When unpacking a tarball with the unpackin-family of functions it's intended that only files within the specified directory are able to be written. Tarballs with hard links or symlinks, however, can be used to overwrite any file on the filesystem. Tarballs can contain multiple entries for the sam...
async_docker (>=0.1.0, <=0.1.1), cargo (>=0.4.0, <=0.8.0) +11 more potentially affected by CVE-2018-20990 via tar (>=0.2.14, <=0.3.4)
tar CARGO version =0.2.14, =0.1.0, =0.4.0, =0.3.1, =0.1.0, =0.3.0, =0.2.0, =0.2.0, =0.2.1, =0.0.1, =0.0.9 - wormhole 0.1.0 Source cves: CVE-2018-20990 Source advisory: OSV:GHSA-2367-C296-3MP2...
SUSE-SU-2021:2834-1 Security update for unrar
This update for unrar to version 5.6.1 fixes several issues. These security issues were fixed: - CVE-2017-12938: Prevent remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file...
The vulnerability of the Apache Commons Compress library, related to the allocation of unlimited memory, allows attackers to cause a service failure.
The vulnerability of the Apache Commons Compress library is related to the allocation of unlimited memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by using specially created TAR format files...
Security Bulletin: IBM Content Navigator is vulnerable to a denial of service vulnerabilty.
Summary IBM Content Navigator has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2021-35516 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error when allocate large amounts of memory. By persuading a victim to open ...
CVE-2021-38511
An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal...
CVE-2021-38511
An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal...
