Published: 25/07/2018 Updated: 09/10/2019

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 384

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

QuaZIP prior to 0.7.6 is vulnerable to directory traversal, allowing malicious users to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Vulnerable Product	Search on Vulmon	Subscribe to Product
quazip project quazip

Debian Bug report logs - #902786 CVE-2018-1002209 Package: src:libquazip; Maintainer for src:libquazip is Debian Med Packaging Team <debian-med-packaging@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Sat, 30 Jun 2018 20:51:07 UTC Severity: grave Tags: security Found in version libq ...

CWE-22 https://snyk.io/research/zip-slip-vulnerability https://github.com/stachenov/quazip/commit/5d2fc16a1976e5bf78d2927b012f67a2ae047a98 https://github.com/stachenov/quazip/blob/0.7.6/NEWS.txt https://github.com/snyk/zip-slip-vulnerability https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=902786 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2018-1002209

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect