Published: 03/10/2016 Updated: 15/03/2024

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 828

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

The extractTree function in unADF allows remote malicious users to execute arbitrary code via shell metacharacters in a directory name in an adf file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
unadf project unadf 1.0
debian debian linux 8.0
debian debian linux 7.0

Debian Bug report logs - #838248 unadf: CVE-2016-1243 and CVE-2016-1244 Package: src:unadf; Maintainer for src:unadf is Debian QA Group <packages@qadebianorg>; Reported by: Luciano Bello <luciano@debianorg> Date: Mon, 19 Sep 2016 02:45:02 UTC Severity: grave Tags: patch, security, upstream Found in version unadf/ ...

Tuomas Räsänen discovered two vulnerabilities in unADF, a tool to extract files from an Amiga Disk File dump (adf): CVE-2016-1243 A stack buffer overflow in the function extractTree() might allow an attacker, with control on the content of a ADF file, to execute arbitrary code with the privileges of the program execution CVE-2016-1 ...

A free, portable and open implementation of the Amiga filesystem

ADFlib (Amiga Disk File library) Introduction The ADFlib is a free, portable and open implementation of the Amiga filesystem The initial release was in 1999 It supports: floppy and hard disk images ("dumps") mount, unmount, create a device image (an adf file) or a volume (a partition inside a device) create, open, close, delete, rename/move a file or a directory fi

CWE-20 http://www.debian.org/security/2016/dsa-3676 http://tmp.tjjr.fi/0001-Fix-unsafe-extraction-by-using-mkdir-instead-of-shel.patch https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838248 http://www.securityfocus.com/bid/93332 https://security.gentoo.org/glsa/201804-20 https://lists.debian.org/debian-lts-announce/2024/03/msg00015.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838248 https://www.debian.org/security/./dsa-3676 https://nvd.nist.gov https://github.com/lclevy/ADFlib

CVE-2016-1244

Vulnerability Summary

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect