CVE-2018-17828

Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.

References

Affected packages

Debian:11 / zziplib

Package

Name: zziplib
Purl: pkg:deb/debian/zziplib?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.13.62-3.3

0.13.62-3.3+deb11u1

0.13.72+dfsg.1-1

0.13.72+dfsg.1-1.1

0.13.72+dfsg.1-1.2~exp1

0.13.72+dfsg.1-1.2

0.13.72+dfsg.1-1.3

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:12 / zziplib

Package

Name: zziplib
Purl: pkg:deb/debian/zziplib?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.13.72+dfsg.1-1.1

0.13.72+dfsg.1-1.2~exp1

0.13.72+dfsg.1-1.2

0.13.72+dfsg.1-1.3

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:13 / zziplib

Package

Name: zziplib
Purl: pkg:deb/debian/zziplib?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.13.72+dfsg.1-1.1

0.13.72+dfsg.1-1.2~exp1

0.13.72+dfsg.1-1.2

0.13.72+dfsg.1-1.3

Ecosystem specific

{
    "urgency": "unimportant"
}

Git / github.com/gdraheim/zziplib

Affected ranges

Type: GIT
Repo: https://github.com/gdraheim/zziplib
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

9d82e19c7f654722f9e37deaa9eb91c25ad544ec

Affected versions

v0.*

v0.13.36

v0.13.48

v0.13.50

v0.13.51

v0.13.52

v0.13.54

v0.13.55

v0.13.56

v0.13.57

v0.13.58

v0.13.59

v0.13.60

v0.13.61

v0.13.62

v0.13.63

v0.13.64

v0.13.65

v0.13.66

v0.13.67

v0.13.68

v0.13.69