CVE-2021-38511

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal...

Design/Logic Flaw

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal...

UBUNTU-CVE-2021-38511

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal...

CVE-2021-38511

CVE-2021-38511 affects the Rust tar crate prior to 0.4.36. When a TAR archive contains symlinks, extraction can perform a directory traversal with “..”, potentially creating arbitrary directories. Practical impact is described as partial integrity/authoritative access loss during extraction; expl...

CVE-2021-38511

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal...

Path Traversal

github.com/gen2brain/go-unarr is vulnerable to path traversal. The vulnerability exists because it does not check the contents of the archive, allowing an attacker to use ../ in a pathname within a TAR archive.By triggering the path traversal vulnerability, an attacker can store any file in any...

go-unarr directory traversal vulnerability

go-unarr is an open source go language library for decompressing RAR, TAR, ZIP and 7z archives. go-unarr version 0.1.1 is vulnerable to a directory traversal vulnerability that could be exploited to write arbitrary files on the system via specially crafted TAR archives...

Alexcrichton Tar-rs 路径遍历漏洞

Alexcrichton Tar-rs is a tar archive read/write library for Rust. A path traversal vulnerability exists in Alexcrichton Tar-rs, which stems from a logical error in the implementation of the product's decompression feature, and could allow an attacker to create files in other directories by...

Security update for apache-commons-compress (important)

openSUSE Security Update: Security update for apache-commons-compress Announcement ID: openSUSE-SU-2021:1115-1 Rating: important References: 1188463 1188464 1188465 1188466 Cross-References: CVE-2021-35515 CVE-2021-35516 CVE-2021-35517 CVE-2021-36090 CVSS scores: CVE-2021-35515 NVD : 7.5...

OPENSUSE-SU-2021:1115-1 Security update for apache-commons-compress

This update for apache-commons-compress fixes the following issues: - Updated to 1.21 - CVE-2021-35515: Fixed an infinite loop when reading a specially crafted 7Z archive. bsc1188463 - CVE-2021-35516: Fixed an excessive memory allocation when reading a specially crafted 7Z archive. bsc1188464 -...

CVE-2021-38197

unarr.go in go-unarr aka Go bindings for unarr 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive...

Directory traversal

unarr.go in go-unarr aka Go bindings for unarr 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive...

CVE-2021-38197

CVE-2021-38197 affects go-unarr (Go bindings for unarr) version 0.1.1, where a Directory Traversal flaw allows the use of .. in TAR archive paths to access files outside the intended directory. This vulnerability is corroborated across multiple sources (NVD entry, GHSA, OSV, Veracode, CNVD, and o...

go-unarr 路径遍历漏洞

go-unarr is an open source go language library for decompressing RAR, TAR, ZIP and 7z archives. go-unarr version 0.1.1 is vulnerable to a directory traversal vulnerability that could be exploited to write arbitrary files on the system via specially crafted TAR archives...

PT-2021-22005 · Go-Unarr · Go-Unarr

Name of the Vulnerable Software and Affected Versions: go-unarr versions 0.1.1 Description: The issue allows Directory Traversal via ../ in a pathname within a TAR archive. This is possible due to a flaw in the unarr.go file in go-unarr. Recommendations: For go-unarr version 0.1.1, consider...

OESA-2021-1302 apache-commons-compress security update

The Apache Commons Compress library defines an API for working with ar, cpio, Unix dump, tar, zip, gzip, XZ, Pack200 and bzip2 files. Security Fixes: When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error...

SUSE SLED15 / SLES15 Security Update : apache-commons-compress (SUSE-SU-2021:2612-1)

The remote SUSE Linux SLED15 / SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2612-1 advisory. - Updated to 1.21 - CVE-2021-35515: Fixed an infinite loop when reading a specially crafted 7Z archive. bsc1188463 - CVE-2021-35516:...

CVE-2021-32803

The npm package "tar" aka node-tar has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted...

CVE-2021-32804

The npm package "tar" aka node-tar has an arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This i...

SUSE-SU-2021:2612-1 Security update for apache-commons-compress

This update for apache-commons-compress fixes the following issues: - Updated to 1.21 - CVE-2021-35515: Fixed an infinite loop when reading a specially crafted 7Z archive. bsc1188463 - CVE-2021-35516: Fixed an excessive memory allocation when reading a specially crafted 7Z archive. bsc1188464 -...