5.8
CVSSv2

CVE-2018-17828

Published: 01/10/2018 Updated: 28/11/2018
CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8
VMScore: 516
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P

Vulnerability Summary

Directory traversal vulnerability in ZZIPlib 0.13.69 allows malicious users to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

zziplib project zziplib 0.13.69

Vendor Advisories

Synopsis Moderate: zziplib security update Type/Severity Security Advisory: Moderate Topic An update for zziplib is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, wh ...
Synopsis Moderate: zziplib security update Type/Severity Security Advisory: Moderate Topic An update for zziplib is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, wh ...
It was discovered that zziplib is vulnerable to a directory traversal flaw in most of its unzip binaries, including unzip-mem, unzzipcat-mem, unzzipcat-big, unzzipcat-mix, and unzzipcat-zip An attacker may use this flaw to write files outside the intended target directory, overwriting existing files, or creating new ones (CVE-2018-17828) ...
It was discovered that zziplib is vulnerable to a directory traversal flaw in most of its unzip binaries, including unzip-mem, unzzipcat-mem, unzzipcat-big, unzzipcat-mix, and unzzipcat-zip An attacker may use this flaw to write files outside the intended target directory, overwriting existing files, or creating new ones ...