CVE-2019-14452

Опубликовано: 31 июл. 2019

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.

Ссылки

https://github.com/Sigil-Ebook/Sigil/commit/04e2f280cc4a0766bedcc7b9eb56449ceecc2ad4
Patch
Third Party Advisory
https://github.com/Sigil-Ebook/Sigil/commit/0979ba8d10c96ebca330715bfd4494ea0e019a8f
Patch
Third Party Advisory
https://github.com/Sigil-Ebook/Sigil/commit/369eebe936e4a8c83cc54662a3412ce8bef189e4
Patch
Third Party Advisory
https://github.com/Sigil-Ebook/Sigil/compare/ea7f27d...5b867e5
Third Party Advisory
https://github.com/Sigil-Ebook/Sigil/releases/tag/0.9.16
Release Notes
Third Party Advisory
https://github.com/Sigil-Ebook/flightcrew/issues/52#issuecomment-505967936
Third Party Advisory
https://github.com/Sigil-Ebook/flightcrew/issues/52#issuecomment-505997355
Third Party Advisory
https://salvatoresecurity.com/zip-slip-in-sigil-cve-2019-14452/
https://usn.ubuntu.com/4085-1/
Third Party Advisory
https://github.com/Sigil-Ebook/Sigil/commit/04e2f280cc4a0766bedcc7b9eb56449ceecc2ad4
Patch
Third Party Advisory
https://github.com/Sigil-Ebook/Sigil/commit/0979ba8d10c96ebca330715bfd4494ea0e019a8f
Patch
Third Party Advisory
https://github.com/Sigil-Ebook/Sigil/commit/369eebe936e4a8c83cc54662a3412ce8bef189e4
Patch
Third Party Advisory
https://github.com/Sigil-Ebook/Sigil/compare/ea7f27d...5b867e5
Third Party Advisory
https://github.com/Sigil-Ebook/Sigil/releases/tag/0.9.16
Release Notes
Third Party Advisory
https://github.com/Sigil-Ebook/flightcrew/issues/52#issuecomment-505967936
Third Party Advisory
https://github.com/Sigil-Ebook/flightcrew/issues/52#issuecomment-505997355
Third Party Advisory
https://salvatoresecurity.com/zip-slip-in-sigil-cve-2019-14452/
https://usn.ubuntu.com/4085-1/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sigil-ebook:sigil:*:*:*:*:*:*:*:*

Версия до 0.9.16 (исключая)

Конфигурация 2

cpe:2.3:a:flightcrew_project:flightcrew:*:*:*:*:*:sigil:*:*

Версия от 0.9.2 (включая)

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

EPSS

Процентиль: 86%

0.03043

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

CVE-2019-14452

CVSS3: 7.5

ubuntu

больше 6 лет назад

Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.

CVE-2019-14452

CVSS3: 7.5

debian

больше 6 лет назад

Sigil before 0.9.16 is vulnerable to a directory traversal, allowing a ...

GHSA-4h5v-f3pf-4x55

CVSS3: 7.5

github

больше 3 лет назад

Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.

BDU:2020-03315

CVSS3: 7.5

fstec

больше 6 лет назад

Уязвимость программное средство редактирования электронных книг в формате EPUB Sigil, существующая из-за неверного ограничения имени пути к каталогу с ограниченным доступом, позволяющая нарушителю записать произвольные файлы в произвольную директорию

EPSS

Процентиль: 86%

0.03043

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22