RSS   Vulnerabilities for 'Rubyzip'   RSS

2019-09-25
 
CVE-2019-16892

CWE-400
 

 
In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

 
2018-06-26
 
CVE-2018-1000544

CWE-434
 

 
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem..

 


Copyright 2024, cxsecurity.com

 

Back to Top