SUSE-SU-2020:0557-1 Security update for python36

This update for python36 fixes the following issues: Security issues fixed: - CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs bsc1162825. - CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP bsc1162367. Non-security issue...

openSUSE Security Update : python3 (openSUSE-2020-274)

This update for python3 fixes the following issues : Security issues fixed : - CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs bsc1162825. - CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP bsc1162367. Non-security issu...

OPENSUSE-SU-2020:0274-1 Security update for python3

This update for python3 fixes the following issues: Security issues fixed: - CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs bsc1162825. - CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP bsc1162367. Non-security issue...

Security update for python3 (moderate)

openSUSE Security Update: Security update for python3 Announcement ID: openSUSE-SU-2020:0274-1 Rating: moderate References: 1162224 1162367 1162423 1162825 Cross-References: CVE-2019-9674 CVE-2020-8492 Affected Products: openSUSE Leap 15.1 An update that solves two vulnerabilities and has two fix...

CVE-2020-9399

The Avast AV parsing engine allows virus-detection bypass via a crafted ZIP archive. This affects versions before 12 definitions 200114-0 of Antivirus Pro, Antivirus Pro Plus, and Antivirus for Linux...

Design/Logic Flaw

The Avast AV parsing engine allows virus-detection bypass via a crafted ZIP archive. This affects versions before 12 definitions 200114-0 of Antivirus Pro, Antivirus Pro Plus, and Antivirus for Linux...

CVE-2020-9399

The Avast AV parsing engine allows virus-detection bypass via a crafted ZIP archive. This affects versions before 12 definitions 200114-0 of Antivirus Pro, Antivirus Pro Plus, and Antivirus for Linux...

CVE-2020-9399

The CVE-2020-9399 entry concerns the Avast AV parsing engine where a crafted ZIP archive can bypass virus detection. Affected products are Antivirus Pro, Antivirus Pro Plus, and Antivirus for Linux (prior to 12 definitions 200114-0). The description primarily states the bypass vector (crafted ZIP...

Arbitrary File Write

decompress is vulnerable to path traversal. The vulnerability exists due to a zip slip vulnerability. Improper handling of archives containing files that has ../ in its names allows the files to be written out of the intended path...

SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:0510-1)

This update for python fixes the following issues : Security issues fixed : CVE-2019-9674: Improved the documentation, warning about dangers of zip-bombs bsc1162825. CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP bsc1162367. Note that Tenable...

SUSE-SU-2020:0510-1 Security update for python

This update for python fixes the following issues: Security issues fixed: - CVE-2019-9674: Improved the documentation, warning about dangers of zip-bombs bsc1162825. - CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP bsc1162367...

The vulnerability of the zzip_disk_findfirst function in the ZZIPlib compression library, which stems from incorrect calculation of buffer size, allows a hacker to cause a service failure.

The vulnerability of the zzipdiskfindfirst function in the ZZIPlib compression library is related to incorrect calculation of buffer size. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures by using a specially created zip file...

The vulnerability of the `__zzip_fetch_disk_trailer` function in the ZZIPlib compression library, which stems from insufficient validation of input data, allows attackers to trigger a service failure.

The vulnerability of the zzipfetchdisktrailer function in the ZZIPlib compression library is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures by using a specially created zip file...

The vulnerability of the zzip_disk_fread function in the ZZIPlib library, related to the occurrence of operations outside the buffer’s boundaries, allows a hacker to cause a service failure.

The vulnerability of the zzipdiskfread function in the ZZIPlib compression library is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures by using a specially created zip file...

Cisco Email Security Appliance Content Filter Bypass Vulnerability (CSCvq65126)

According to its self-reported version, Cisco Email Security Appliance ESA is affected by an input-validation flaw related to the email message filtering feature and zip files that allows denial of service attacks. Please see the included Cisco BID and Cisco Security Advisory for more information...

SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:0467-1)

This update for python3 fixes the following issues : Security issues fixed : CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs bsc1162825. CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP bsc1162367. Non-security issue...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview dariusiii/zipper is a Simple Wrapper around the ZipArchive methods with some handy functions. This package is an updated fork of Chumper/Zipper. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. ZIP Path traversal is possible during...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview chumper/zipper is a little neat helper for the ZipArchive methods with handy functions. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. ZIP Path traversal is possible during extraction due to no validation and sanitization of...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview madnest/madzipper is a Wannabe successor of Chumper/Zipper package for Laravel. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. ZIP Path traversal is possible during extraction due to no validation and sanitization of filenames. P...

SUSE-SU-2020:0467-1 Security update for python3

This update for python3 fixes the following issues: Security issues fixed: - CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs bsc1162825. - CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP bsc1162367. Non-security issue...