CVE-2017-8314
published 2017-05-23CVE-2017-8314: Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.
PriorityP431medium5.5CVSS 3.0
AVLACLPRNUIRSUCNIHAN
EPSS
2.47%
82.9th percentile
Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | kodi | < kodi 2:17.1+dfsg1-3 (bookworm) | kodi 2:17.1+dfsg1-3 (bookworm) |
| kodi | kodi | <= 17.1 | — |
| kodi | kodi | >= 0 < 2:17.1+dfsg1-3 | 2:17.1+dfsg1-3 |
| kodi | kodi | >= 0 < 2:17.1+dfsg1-3 | 2:17.1+dfsg1-3 |
| kodi | kodi | >= 0 < 2:17.1+dfsg1-3 | 2:17.1+dfsg1-3 |
| xbmc_foundation | kodi | <= v17.1 | — |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv5.5MEDIUM
vendor_debian5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2017-8314: kodi - Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier...
vendor_debian·2017·CVSS 5.5
CVE-2017-8314 [MEDIUM] CVE-2017-8314: kodi - Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier...
Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.
Scope: local
bookworm: resolved (fixed in 2:17.1+dfsg1-3)
bullseye: resolved (fixed in 2:17.1+dfsg1-3)
sid: resolved (fixed in 2:17.1+dfsg1-3)
trixie: resolved (fixed in 2:17.1+dfsg1-3)
GHSA
GHSA-xc9h-m4wq-vhxg: Directory Traversal in Zip Extraction built-in function in Kodi 17
ghsa_unreviewed·2022-05-13
CVE-2017-8314 [MEDIUM] CWE-22 GHSA-xc9h-m4wq-vhxg: Directory Traversal in Zip Extraction built-in function in Kodi 17
Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.
OSV
CVE-2017-8314: Directory Traversal in Zip Extraction built-in function in Kodi 17
osv·2017-05-23·CVSS 5.5
CVE-2017-8314 [MEDIUM] CVE-2017-8314: Directory Traversal in Zip Extraction built-in function in Kodi 17
Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.
No detection rules found.
No public exploits indexed.
Checkpoint
Hacked in Translation – “Director’s Cut” – Full Technical Details
blogs_checkpoint·2017-07-08
CVE-2017-8314 Hacked in Translation – “Director’s Cut” – Full Technical Details
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Hacked in Translation – “Director’s Cut” – Full Technical Details
Background
Recently, Check Point researchers revealed a brand new attack vector – attack by subtitles. As discussed in th
arXiv
Hacked in Translation -- from Subtitles to Complete Takeover
arxiv_fulltext·2024-08-01
Hacked in Translation -- from Subtitles to Complete Takeover
## Background
Check Point researchers revealed a new attack vector which threatens millions of users worldwide - attack by subtitles. By crafting malicious subtitle files, which are then downloaded by a victim's media player, attackers can take complete control over any type of device via vulnerabilities found in many popular streaming platforms, including VLC, Kodi (XBMC), Popcorn-Time and strem.io. We estimate there are approximately 200 million video players and streamers that currently run the vulnerable software, making this one of the most widespread, easily accessed and zero-resistance vulnerability reported in recent years.
Our research reveals a new possible attack vector, using a completely overlooked technique in which the cyberattack is delivered when movie subtitles are auto
http://www.securityfocus.com/bid/98668https://github.com/xbmc/xbmc/pull/12024https://lists.debian.org/debian-lts-announce/2018/01/msg00019.htmlhttps://security.gentoo.org/glsa/201706-17http://www.securityfocus.com/bid/98668https://github.com/xbmc/xbmc/pull/12024https://lists.debian.org/debian-lts-announce/2018/01/msg00019.htmlhttps://security.gentoo.org/glsa/201706-17
2017-05-23
Published