UBUNTU-CVE-2019-13453

Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32 and zipfile.cpp:Zipfile::Zipfile...

PT-2019-5540

Name of the Vulnerable Software and Affected Versions Python versions through 3.7.2 Description The issue is related to an uncontrolled resource consumption in the zipfile module of the Python package. This can be exploited by a remote attacker using a malicious ZIP bomb file, leading to a denial...

idreamsoft iCMS Directory Traversal Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A security vulnerability exists in idreamsoft iCMS version 7.0.13. The vulnerability can be exploited to execute arbitrary PHP code in a ZIP file with the help of 'udir' and 'zipfile' parameters...

PT-2019-18443

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.13 Description The issue allows for directory traversal via the udir parameter in admincp.php?app=files to files.admincp.php, potentially leading to the execution of arbitrary PHP code from a ZIP file through the...

SQLite report about CVE-2019-19925

Malicious SQL statement causes a NULL pointer dereference and in the Zipfile virtual table extension and denial-of-service. This is only possible when the optional Zipfile virtual table extension is deployed, which is not the case in default builds. details...

SQLite report about CVE-2019-19959

Malicious SQL statement causes a NULL pointer dereference in the Zipfile virtual table extension and denial-of-service. This is only possible when the optional Zipfile virtual table extension is deployed, which is not the case in default builds. details...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview System.IO.Compression.ZipFile provides classes that support the compression and decompression of streams using file system paths. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. An attacker could write arbitrary files and...

CVE-2018-1324

A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip...

CVE-2018-1324

A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip...

CVE-2018-1324

A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip...

CVE-2018-1324

A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip...

CVE-2018-1324: Loop with Unreachable Exit Condition

A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip...

PT-2017-4078

Name of the Vulnerable Software and Affected Versions Apache Commons Compress versions 1.11 through 1.15 Description A specially crafted ZIP archive can cause an infinite loop inside Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes. This can be use...

The vulnerability of the PHP interpreter allows attackers to obtain confidential information or cause service failures.

The vulnerability of the pharparsezipfile function in zip.c of the PHP PHAR interpreter is caused by buffer overflow. Exploiting this vulnerability can allow an attacker to obtain confidential information or cause a service failure such as out-of-memory reading or application termination by placi...

Fedora Update for nodejs-zipfile FEDORA-2016-6

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 24 Update: nodejs-zipfile-0.5.9-7.fc24

Bindings to libzip for handling zipfile archives in Node.js...

PHP PHAR extension 'phar_parse_zipfile' function buffer overflow vulnerability

PHP is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community.PHAR is one of the archived extensions. A security vulnerability exists in the 'pharparsezipfile' function in the zip.c file of PHP's PHAR extension, which allows a remote...

PT-2016-1607

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.5.33 PHP versions 5.6.x prior to 5.6.19 Description The issue is caused by a buffer overflow in the phar parse zipfile function of the PHAR extension in PHP. This can be exploited by a remote attacker to obtain sensitiv...

UBUNTU-CVE-2016-3142

The pharparsezipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service out-of-bounds read and application crash by placing a PK\x05\x06 signature at an inval...

PT-2015-3422

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.5.30 PHP versions 5.6.x prior to 5.6.14 Description The issue is related to an off-by-one error in the phar parse zipfile function, which can be exploited by remote attackers to cause a denial of service. This is achiev...