Sharpziplib Project Sharpziplib vulnerabilities

4 known vulnerabilities affecting sharpziplib_project/sharpziplib.

Total CVEs
4
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1MEDIUM3

Vulnerabilities

Page 1 of 1
CVE-2021-32840CRITICALCVSS 9.8fixed in 1.3.32022-01-26
CVE-2021-32840 [CRITICAL] CWE-22 CVE-2021-32840: SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file e SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry `../evil.txt` may be extracted in the parent directory of `destFolder`. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.
ghsanvdosv
CVE-2021-32841MEDIUMCVSS 5.3≥ 1.3.0, < 1.3.32022-01-26
CVE-2021-32841 [MEDIUM] CWE-22 CVE-2021-32841: SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that `destDir` ends with slash. If the `destDir` is not slash terminated like `/home/user/dir` it is possible to create a file with a na
ghsanvdosv
CVE-2021-32842MEDIUMCVSS 5.3≥ 1.0.0, < 1.3.32022-01-26
CVE-2021-32842 [MEDIUM] CWE-22 CVE-2021-32842: SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that `_baseDirectory` ends with slash. If the _baseDirectory is not slash terminated like `/home/user/dir` it is possible to create a
ghsanvdosv
CVE-2018-1002208MEDIUMCVSS 5.5≤ 0.86.0.5182018-07-25
CVE-2018-1002208 [MEDIUM] CWE-22 CVE-2018-1002208: SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbi SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
ghsanvdosv