CVE-2018-17828 — Path Traversal in Zziplib

CWE-22 — Path Traversal8 documents7 sources
Severity
5.5MEDIUMNVD
EPSS
0.5%
top 32.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Gdraheim ZziplibDebian ZziplibMsrc Cbl2 Zziplib 0.13.69-8 ON CBL Mariner 2.0+2 more
Timeline
PublishedOct 1
Latest updateMay 14

Description

Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶NVDgdraheim/zziplib0.13.69

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-g8rp-fvg9-52vv: Directory traversal vulnerability in ZZIPlib 0↗2022-05-14
▶
OSV
CVE-2018-17828: Directory traversal vulnerability in ZZIPlib 0↗2018-10-01
▶

📋Vendor Advisories

3
Microsoft
Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file because of the function unzzip_cat in the bins/unzzipcat-mem.c file.↗2018-10-09
▶
Red Hat
zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c↗2018-09-25
▶
Debian
CVE-2018-17828: zziplib - Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwri...↗2018
▶

💬Community

2
Bugzilla
CVE-2018-17828 zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c [fedora-all]↗2018-10-03
▶
Bugzilla
CVE-2018-17828 zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c↗2018-10-03
▶