CVE-2010-2322

2010-06-1800:00:00

ubuntu.com

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

0.013 Low

EPSS

Percentile

85.9%

JSON

Absolute path traversal vulnerability in the extract_jar function in
jartool.c in FastJar 0.98 allows remote attackers to create or overwrite
arbitrary files via a full pathname for a file within a .jar archive, a
related issue to CVE-2010-0831. NOTE: this vulnerability exists because of
an incomplete fix for CVE-2006-3619.

Notes

Author	Note
kees	I think this was fixed along with CVE-2010-0831 in USN-953-1
mdeslaur	confirmed, it was fixed with USN-953-1 for jar in openjdk-6, see CVE-2005-1080

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchfastjar< 2:0.95-1ubuntu2.1UNKNOWN
ubuntu9.04noarchfastjar< 2:0.97-3ubuntu0.1UNKNOWN
ubuntu9.10noarchfastjar< 2:0.98-1ubuntu0.9.10.1UNKNOWN
ubuntu10.04noarchfastjar< 2:0.98-1ubuntu0.10.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	fastjar	< 2:0.95-1ubuntu2.1	UNKNOWN
ubuntu	9.04	noarch	fastjar	< 2:0.97-3ubuntu0.1	UNKNOWN
ubuntu	9.10	noarch	fastjar	< 2:0.98-1ubuntu0.9.10.1	UNKNOWN
ubuntu	10.04	noarch	fastjar	< 2:0.98-1ubuntu0.10.04.1	UNKNOWN