CVE-2019-14866

In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have...

CVE-2019-14866

In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have...

CVE-2019-14866

CVE-2019-14866 affects GNU cpio: all versions before 2.13 improperly validate input when generating TAR archives, enabling a local attacker to cause files with unintended permissions or paths when creating archives. Exploitation relies on archiving from paths, potentially enabling high-privilege ...

CVE-2018-1000075

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can...

EulerOS 2.0 SP8 : tar (EulerOS-SA-2020-1035)

According to the version of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The GNU tar program saves many files together in one archive and can restore individual files or all of the files from that archive. Tar can also be us...

Photon OS 2.0: Tar PHSA-2019-2.0-0187

An update of the tar package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-2.0-0187. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid132546;...

NewStart CGSL CORE 5.05 / MAIN 5.05 : perl-Archive-Tar Vulnerability (NS-SA-2019-0230)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has perl-Archive-Tar packages installed that are affected by a vulnerability: - In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitra...

EulerOS 2.0 SP5 : cpio (EulerOS-SA-2019-2687)

According to the version of the cpio package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was discovered cpio does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an...

The vulnerability of the sanitize_filename function in the src/glib-utils.c file of the File Roller archive program allows a malicious actor to cause a service failure.

The vulnerability of the sanitizefilename function in the src/glib-utils.c file of the File Roller archive manager is related to a lack of mechanisms to restrict the path to the restricted directory. Exploiting this vulnerability could allow an attacker to cause service failure through a speciall...

Drupal Warns Web Admins to Update CMS Sites to Patch a Critical Flaw

If you haven't recently updated your Drupal-based blog or business website to the latest available versions, it's the time. Drupal development team yesterday released important security updates for its widely used open-source content management software that addresses a critical and three...

Drupal Warns Web Admins to Update CMS Sites to Patch a Critical Flaw

If you haven't recently updated your Drupal-based blog or business website to the latest available versions, it's the time. Drupal development team yesterday released important security updates for its widely used open-source content management software that addresses a critical and three...

DRUPAL-CORE-2019-012

The Drupal project uses the third-party library Archive\Tar, which has released a security improvement that is needed to protect some Drupal configurations. Multiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and processes them. The late...

EulerOS 2.0 SP3 : perl (EulerOS-SA-2019-2648)

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - 1 cpan/Archive-Tar/bin/ptar, 2 cpan/Archive-Tar/bin/ptardiff, 3 cpan/Archive-Tar/bin/ptargrep, 4 cpan/CPAN/scripts/cpan, 5 cpan/Digest-SHA/shasum,...

EulerOS 2.0 SP3 : tar (EulerOS-SA-2019-2673)

According to the version of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Directory traversal vulnerability in the safernamesuffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended...

The vulnerability of the node-tar and fstream packages in Microsoft Visual Studio software allows a hacker to modify any files they choose.

The vulnerability of the node-tar and fstream packages in the Microsoft Visual Studio development environment is related to errors during the checking of hard links when extracting archive files. Exploiting this vulnerability allows a remote attacker to modify arbitrary files by loading a malicio...

Threat Analysis Unit (TAU) Threat Intelligence Notification: Skidmap

Hijacking machine resources and using them to mine for cryptocurrency continues to be an attractive and lucrative target for threat actors. As we’ve continued to see this type of attack used, we’ve also seen more platforms being targeted. Seeing cryptocurrency mining malware targeting Linux and...

EulerOS 2.0 SP2 : perl-Archive-Tar (EulerOS-SA-2019-2415)

According to the version of the perl-Archive-Tar package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrit...

[SECURITY] Fedora 31 Update: tnef-1.4.18-1.fc31

This application provides a way to unpack Microsoft MS-TNEF MIME attachment s. It operates like tar in order to unpack files of type "application/ms-tnef", which may have been placed into the MS-TNEF attachment instead of being attached separately. Such files may have attachment names similar to...

EulerOS 2.0 SP2 : tar (EulerOS-SA-2019-2423)

According to the version of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Directory traversal vulnerability in the safernamesuffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended...

openSUSE Security Update : cpio (openSUSE-2019-2593)

This update for cpio fixes the following issues : - CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the tooct function which could have led to unexpected TAR generation bsc1155199. This update was imported from the SUSE:SLE-15:Update update...