Описание
QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | ignored | end of life |
| bionic | ignored | end of standard support, was needed |
| cosmic | not-affected | 0.7.6-1 |
| devel | DNE | |
| disco | not-affected | 0.7.6-1 |
| eoan | not-affected | 0.7.6-1 |
| esm-apps-legacy/xenial | needed | |
| esm-apps/bionic | needed | |
| esm-apps/focal | not-affected | 0.7.6-1 |
| esm-apps/jammy | not-affected | 0.7.6-1 |
Показывать по
EPSS
4.3 Medium
CVSS2
5.5 Medium
CVSS3
Связанные уязвимости
QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing att ...
QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Уязвимость функции extractDir компонента JICompress библиотеки QuaZIP, позволяющая нарушителю выполнить произвольный код
ALT-PU-2018-3683: package `libquazip` update to version 0.7.6-alt1
EPSS
4.3 Medium
CVSS2
5.5 Medium
CVSS3