This update for zziplib fixes the following issues :

  - CVE-2018-17828: Remove any '../' components from     pathnames of extracted files to avoid path traversal     during unpacking. (bsc#1110687)

This update was imported from the SUSE:SLE-15:Update update project.

This update for zziplib fixes the following issues :

  - CVE-2018-17828: Remove any '../' components from     pathnames of extracted files to avoid path traversal     during unpacking. (bsc#1110687)

This update was imported from the SUSE:SLE-12:Update update project.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has zziplib packages installed that are affected by a vulnerability:

  - Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a     .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.
    (CVE-2018-17828)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:1653 advisory.

  - Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a     .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.
    (CVE-2018-17828)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1653 advisory.

    - Fix CVE-2018-17828 in the 'single z' binaries

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

* zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1178 advisory.

    The zziplib is a lightweight library to easily extract data from zip files.

    Security Fix(es):

    * zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.01, has zziplib packages installed that are affected by a vulnerability:

  - Directory traversal vulnerability in ZZIPlib 0.13.69     allows attackers to overwrite arbitrary files via a ..
    (dot dot) in a zip file, because of the function     unzzip_cat in the bins/unzzipcat-mem.c file.
    (CVE-2018-17828)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

远程 Redhat Enterprise Linux 7 主机上安装的程序包受到 RHSA-2020: 1178 公告中提及的漏洞的影响。

  - zziplib：bins/unzzipcat-mem.c 的 unzzip_cat 中的目录遍历 (CVE-2018-17828)

请注意，Nessus 尚未测试此问题，而是只依赖于应用程序自我报告的版本号。

* zziplib：bins/unzzipcat-mem.c 的 unzzip_cat 中的目录遍历

运行 MAIN 6.01 版本的远程 NewStart CGSL 主机上安装的 zziplib 程序包受到漏洞的影响：

  - ZZIPlib 0.13.69 中的目录遍历漏洞允许攻击者通过 zip 文件中的 ..（点点）覆盖任意文件，
    这是 bins/unzzipcat-mem.c 文件中的 unzzip_cat 函数所致。
    (CVE-2018-17828)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号。

远程 Rocky Linux 8 主机上存在安装的程序包该程序包受到公告 RLSA-2020:1653 中提及的漏洞的影响。

  - ZZIPlib 0.13.69 中的目录遍历漏洞允许攻击者通过 zip 文件中的 ..（点点）覆盖任意文件，这是 bins/unzzipcat-mem.c 文件中的函数 unzzip_cat 所致。
    (CVE-2018-17828)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

运行 CORE 5.05 / MAIN 5.05 版本的远程 NewStart CGSL 主机上安装的 zziplib 程序包受到漏洞的影响：

  - ZZIPlib 0.13.69 中的目录遍历漏洞允许攻击者通过 zip 文件中的 ..（点点）覆盖任意文件，这是 bins/unzzipcat-mem.c 文件中的函数 unzzip_cat 所致。
    (CVE-2018-17828)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号。

远程 Oracle Linux 8 主机上安装的多个程序包受到 ELSA-2020-1653 公告中提及的漏洞的影响。

  - ZZIPlib 0.13.69 中的目录遍历漏洞允许攻击者通过 zip 文件中的 ..（点点）覆盖任意文件，这是 bins/unzzipcat-mem.c 文件中的函数 unzzip_cat 所致。
    (CVE-2018-17828)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
118341	openSUSE Security Update : zziplib (openSUSE-2018-1226)	Nessus	SuSE Local Security Checks	2018/10/24	2024/7/29	medium
118447	openSUSE Security Update : zziplib (openSUSE-2018-1277)	Nessus	SuSE Local Security Checks	2018/10/26	2024/7/29	medium
143981	NewStart CGSL CORE 5.05 / MAIN 5.05 : zziplib Vulnerability (NS-SA-2020-0087)	Nessus	NewStart CGSL Local Security Checks	2020/12/9	2024/2/5	medium
184781	Rocky Linux 8 : zziplib (RLSA-2020:1653)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	medium
180957	Oracle Linux 8 : zziplib (ELSA-2020-1653)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	medium
135843	Scientific Linux Security Update : zziplib on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	2020/4/21	2024/3/15	medium
135045	RHEL 7 : zziplib (RHSA-2020:1178)	Nessus	Red Hat Local Security Checks	2020/3/31	2024/11/7	medium
138780	NewStart CGSL MAIN 6.01 : zziplib Vulnerability (NS-SA-2020-0034)	Nessus	NewStart CGSL Local Security Checks	2020/7/21	2024/2/29	medium
135045	RHEL 7：zziplib (RHSA-2020: 1178)	Nessus	Red Hat Local Security Checks	2020/3/31	2024/11/7	medium
135843	Scientific Linux 安全更新：SL7.x x86_64 中的 zziplib (20200407)	Nessus	Scientific Linux Local Security Checks	2020/4/21	2024/3/15	medium
138780	NewStart CGSL MAIN 6.01：zziplib 漏洞 (NS-SA-2020-0034)	Nessus	NewStart CGSL Local Security Checks	2020/7/21	2024/2/29	medium
184781	Rocky Linux 8 zziplib (RLSA-2020:1653)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	medium
143981	NewStart CGSL CORE 5.05 / MAIN 5.05：zziplib 漏洞 (NS-SA-2020-0087)	Nessus	NewStart CGSL Local Security Checks	2020/12/9	2024/2/5	medium
180957	Oracle Linux 8：zziplib (ELSA-2020-1653)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium