GO-2020-0016 Infinite loop in github.com/ulikunitz/xz

An attacker can construct a series of bytes such that calling Reader.Read on the bytes could cause an infinite loop. If parsing user supplied input, this may be used as a denial of service vector...

Arbitrary File Rewrite

spring-integration-zip is vulnerable to an arbitrary file rewrite aka a zip slip vulnerability. An incomplete fix of CVE-2018-1263 allows an attacker to send a malicious zip archive bzip2, tar, xz, war, cpio, 7z with path traversal filenames, leading to writing of files outside of the target...

CVE-2021-22114

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

Path traversal

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

CVE-2021-22114

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

NewStart CGSL CORE 5.04 / MAIN 5.04 : libxml2 Multiple Vulnerabilities (NS-SA-2020-0060)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libxml2 packages installed that are affected by multiple vulnerabilities: - Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of...

Fedora: Security Advisory for golang-github-ulikunitz-xz (FEDORA-2020-e384830a0d)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-github-ulikunitz-xz (FEDORA-2020-deff052e7a)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 32 : golang-github-ulikunitz-xz (2020-e384830a0d)

The readUvarint function would run infinitely given specific input. The function is now terminating if more than 10 bytes of input have been read. Fixes issue 35 CVE-2020-16845. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Fedora 31 : golang-github-ulikunitz-xz (2020-deff052e7a)

The readUvarint function would run infinitely given specific input. The function is now terminating if more than 10 bytes of input have been read. Fixes issue 35 CVE-2020-16845. - Supports the check-ID None and fixes 'Checksum None is invalid' issue 27. Note that Tenable Network Security has...

[SECURITY] Fedora 31 Update: golang-github-ulikunitz-xz-0.5.8-1.fc31

This Go language package supports the reading and writing of xz compressed streams. It includes also a gxz command for compressing and decompressing d ata. The package is completely written in Go and doesn't have any dependency on any C code...

[SECURITY] Fedora 32 Update: golang-github-ulikunitz-xz-0.5.8-1.fc32

This Go language package supports the reading and writing of xz compressed streams. It includes also a gxz command for compressing and decompressing d ata. The package is completely written in Go and doesn't have any dependency on any C code...

[SECURITY] Fedora 30 Update: pxz-4.999.9-19.beta.20200421git.fc30

Parallel XZ is a compression utility that takes advantage of running XZ compression simultaneously on different parts of an input file on multiple cores and processors. This significantly speeds up compression time...

Fedora: Security Advisory for pxz (FEDORA-2020-07fcbfddbd)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 32 Update: pxz-4.999.9-19.beta.20200421git.fc32

Parallel XZ is a compression utility that takes advantage of running XZ compression simultaneously on different parts of an input file on multiple cores and processors. This significantly speeds up compression tim e...

[SECURITY] Fedora 31 Update: pxz-4.999.9-19.beta.20200421git.fc31

Parallel XZ is a compression utility that takes advantage of running XZ compression simultaneously on different parts of an input file on multiple cores and processors. This significantly speeds up compression tim e...

CentOS 7 : libxml2 (RHSA-2020:1190)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1190 advisory. - The xzdecomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a...

Moderate: Red Hat Security Advisory: libxml2 security update

An update for libxml2 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

libxml2: Unrestricted memory usage in xz_head() function in xzlib.c

The xzhead function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service memory consumption via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file...

GHSA-M9JM-RHRM-GCXJ Path traversal in org.springframework.integration:spring-integration-zip

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the filename gets concatenated to th...