Описание
Security update for zziplib
This update for zziplib fixes the following issues:
- CVE-2018-17828: Remove any '../' components from pathnames of extracted files to avoid path traversal during unpacking. (bsc#1110687)
This update was imported from the SUSE:SLE-12:Update update project.
Список пакетов
openSUSE Leap 42.3
libzzip-0-13-0.13.67-13.12.1
libzzip-0-13-32bit-0.13.67-13.12.1
zziplib-0.13.67-13.12.1
zziplib-devel-0.13.67-13.12.1
zziplib-devel-32bit-0.13.67-13.12.1
Ссылки
- E-Mail link for openSUSE-SU-2018:3446-1
- SUSE Security Ratings
Описание
Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.
Затронутые продукты
openSUSE Leap 42.3:libzzip-0-13-0.13.67-13.12.1
openSUSE Leap 42.3:libzzip-0-13-32bit-0.13.67-13.12.1
openSUSE Leap 42.3:zziplib-0.13.67-13.12.1
openSUSE Leap 42.3:zziplib-devel-0.13.67-13.12.1
Ссылки
- CVE-2018-17828
- SUSE Bug 1110687