USN-3935-1 busybox vulnerabilities

Tyler Hicks discovered that BusyBox incorrectly handled symlinks inside tar archives. If a user or automated system were tricked into processing a specially crafted tar archive, a remote attacker could overwrite arbitrary files outside of the current directory. This issue only affected Ubuntu 14....

Long Range Zip Denial of Service Vulnerability (CNVD-2019-14257)

Long Range Zip a.k.a. lrzip is an open source compression utility for large file compression.LZO is one of the lossless data compression algorithms used in... A security vulnerability exists in the 'lzo1xdecompress' function in the liblzo2.so.2 file of LZO version 2.10 used in lrzip version 0.631...

CVE-2019-10654

The lzo1xdecompress function in liblzo2.so.2 in LZO 2.10, as used in Long Range Zip aka lrzip 0.631, allows remote attackers to cause a denial of service invalid memory read and application crash via a crafted archive, a different vulnerability than CVE-2017-8845...

CVE-2019-10654

The lzo1xdecompress function in liblzo2.so.2 in LZO 2.10, as used in Long Range Zip aka lrzip 0.631, allows remote attackers to cause a denial of service invalid memory read and application crash via a crafted archive, a different vulnerability than CVE-2017-8845...

UBUNTU-CVE-2019-10654

The lzo1xdecompress function in liblzo2.so.2 in LZO 2.10, as used in Long Range Zip aka lrzip 0.631, allows remote attackers to cause a denial of service invalid memory read and application crash via a crafted archive, a different vulnerability than CVE-2017-8845...

CVE-2019-10654

The lzo1xdecompress function in liblzo2.so.2 in LZO 2.10, as used in Long Range Zip aka lrzip 0.631, allows remote attackers to cause a denial of service invalid memory read and application crash via a crafted archive, a different vulnerability than CVE-2017-8845...

CVE-2019-10654

The lzo1xdecompress function in liblzo2.so.2 in LZO 2.10, as used in Long Range Zip aka lrzip 0.631, allows remote attackers to cause a denial of service invalid memory read and application crash via a crafted archive, a different vulnerability than CVE-2017-8845...

PT-2019-11967 · None +1 · Lzo +2

Name of the Vulnerable Software and Affected Versions: LZO version 2.10 Long Range Zip lrzip version 0.631 Description: The issue allows remote attackers to cause a denial of service, resulting in an invalid memory read and application crash, via a crafted archive. Recommendations: For LZO versio...

[SECURITY] Fedora 30 Update: libarchive-3.3.3-6.fc30

Libarchive is a programming library that can create and read several differ ent streaming archive formats, including most popular tar variants, several cpio formats, and both BSD and GNU ar variants. It can also write shar archives and read ISO9660 CDROM images and ZIP archives...

[SECURITY] Fedora 30 Update: libzip-1.5.2-1.fc30

libzip is a C library for reading, creating, and modifying zip archives. Fi les can be added from data buffers, files, or compressed data copied directly f rom other zip archives. Changes made without closing the archive can be reverte d. The API is documented by man pages...

[SECURITY] Fedora 30 Update: advancecomp-2.1-10.fc30

AdvanceCOMP is a set of recompression utilities for .PNG, .MNG and .ZIP fil es. The main features are : Recompress ZIP, PNG and MNG files using the Deflate 7-Zip implementation. Recompress MNG files using Delta and Move optimization. This package contains: advzip - Recompression and test utility...

The return of the BOM

There's nothing new in Brazilian cybercriminals trying out new ways to stay under the radar. It's just that this time around the bad guys have started using a method that was reported in the wild years ago. Russian gangs used this technique to distribute malware capable of modifying the hosts fil...

PT-2019-5540

Name of the Vulnerable Software and Affected Versions Python versions through 3.7.2 Description The issue is related to an uncontrolled resource consumption in the zipfile module of the Python package. This can be exploited by a remote attacker using a malicious ZIP bomb file, leading to a denial...

openSUSE Security Update : unzip (openSUSE-2019-509)

This update for unzip fixes the following issues : - CVE-2014-9636: Prevent denial of service out-of-bounds read or write and crash via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression bsc914442 -...

openSUSE Security Update : perl-Archive-Zip (openSUSE-2019-628)

This update for perl-Archive-Zip fixes the following security issue : - CVE-2018-10860: Prevent directory traversal caused by not properly sanitizing paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could have used this flaw to write or...

Design/Logic Flaw

Jenzabar JICS aka Internet Campus Solution before 9 allows remote attackers to upload and execute arbitrary .aspx code by placing it in a ZIP archive and using the MoxieManager for .NET plugin before 2.1.4 in the moxiemanager directory within the installation folder ICS\ICS.NET\ICSFileServer...

CVE-2019-10012

Jenzabar JICS aka Internet Campus Solution before 9 allows remote attackers to upload and execute arbitrary .aspx code by placing it in a ZIP archive and using the MoxieManager for .NET plugin before 2.1.4 in the moxiemanager directory within the installation folder ICS\ICS.NET\ICSFileServer...

Moderate severity vulnerability that affects org.apache.karaf:apache-karaf and org.apache.karaf:karaf

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This...

[SECURITY] Fedora 29 Update: libarchive-3.3.3-6.fc29

Libarchive is a programming library that can create and read several differ ent streaming archive formats, including most popular tar variants, several cpio formats, and both BSD and GNU ar variants. It can also write shar archives and read ISO9660 CDROM images and ZIP archives...

Fedora 29 : libzip (2019-615e060d4e)

Version 1.5.2 - Fix bug in AES encryption affecting certain file sizes - Keep file permissions when modifying zip archives - Support systems with small stack size. - Add nullability annotations. Note that Tenable Network Security has extracted the preceding description block directly from the...