CVE-2018-17828 - zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c

Back Back to CVE browser

MEDIUM

zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c

Published Oct 1, 2018

5.5

MEDIUM

CVSS 3.0

EPSS 1.54%

Description

Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.

Affected products

Red Hat Enterprise Linux 10

zziplib-0:0.13.78-2.el10

Fixed · RHSA-2025:20478
Red Hat Enterprise Linux 7

zziplib-0:0.13.62-12.el7

Fixed · RHSA-2020:1178
Red Hat Enterprise Linux 8

zziplib-0:0.13.68-8.el8

Fixed · RHSA-2020:1653
Red Hat Enterprise Linux 9

zziplib-0:0.13.71-12.el9

Fixed · RHSA-2025:20838

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	zziplib-0:0.13.78-2.el10	Fixed	RHSA-2025:20478
Red Hat Enterprise Linux 7	zziplib-0:0.13.62-12.el7	Fixed	RHSA-2020:1178
Red Hat Enterprise Linux 8	zziplib-0:0.13.68-8.el8	Fixed	RHSA-2020:1653
Red Hat Enterprise Linux 9	zziplib-0:0.13.71-12.el9	Fixed	RHSA-2025:20838

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (5)

https://access.redhat.com/security/cve/CVE-2018-17828
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1635888
Issue Tracking
https://github.com/gdraheim/zziplib/issues/62
x_refsource_MISCExploitPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-17828
https://www.cve.org/CVERecord?id=CVE-2018-17828

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2018-17828		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1635888		Issue Tracking
https://github.com/gdraheim/zziplib/issues/62		x_refsource_MISCExploitPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-17828
https://www.cve.org/CVERecord?id=CVE-2018-17828