CVE-2019-16892

CVE-2019-16892 in Rubyzip: A crafted ZIP can bypass ZIP-entry size checks because the uncompressed size data can be spoofed, enabling a denial of service via disk consumption. Affected: rubyzip before 1.3.0. Root cause: manipulated size metadata in ZIP entries. Impact: local DoS through excessive...

CVE-2018-1000544

CVE-2018-1000544 affects the rubyzip gem (versions up to and including 1.2.1). It enables a Directory Traversal in Zip::File that can write arbitrary files to the filesystem when processing crafted ZIPs (e.g., using symlinks or absolute paths). Public advisories (e.g., Debian DLA-2307-1, RH advis...

CVE-2017-5946

CVE-2017-5946 – Rubyzip directory traversal vulnerability : The Zip::File component of the rubyzip gem for Ruby (pre-1.2.1) allows a ZIP archive to write files outside the target directory when a ZIP upload contains paths with "..". This enables arbitrary file writes on the filesystem if a site p...