Vulnerability CVE-2011-2725


Published: 2014-02-04   Modified: 2014-02-05

Description:
Directory traversal vulnerability in Ark 4.7.x and earlier allows remote attackers to delete and force the display of arbitrary files via .. (dot dot) sequences in a zip file.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
KDE Ark 4.7.4 Directory traversal
Tim Brown
09.02.2014

Type:

CWE-22

(Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

Vendor: KDE
Product: Kde sc 
Version:
4.7.4
4.7.3
4.7.2
4.7.1
4.7.0
Product: ARK 
Version: 2.17;
Vendor: Opensuse
Product: Opensuse 
Version: 11.4;
Vendor: Novell
Product: Opensuse 
Version: 11.4;
Vendor: Canonical
Product: Ubuntu linux 
Version:
11.10
11.04
10.10
10.04

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://lists.opensuse.org/opensuse-updates/2012-03/msg00002.html
http://packetstormsecurity.com/files/105610/Ark-2.16-Directory-Traversal.html
http://seclists.org/fulldisclosure/2011/Oct/351
http://www.ubuntu.com/usn/USN-1276-1
https://bugzilla.novell.com/show_bug.cgi?id=708268
https://bugzilla.redhat.com/show_bug.cgi?id=725764

Related CVE
CVE-2019-17266
libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy.
CVE-2019-16866
Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.
CVE-2019-16928
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
CVE-2019-14835
A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descript...
CVE-2019-10197
A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared ...
CVE-2019-15717
Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP.
CVE-2019-11476
An integer overflow in whoopsie before versions 0.2.52.5ubuntu0.1, 0.2.62ubuntu0.1, 0.2.64ubuntu0.1, 0.2.66, results in an out-of-bounds write to a heap allocated buffer when processing large crash dumps. This results in a crash or possible code-exec...
CVE-2019-15133
In GIFLIB before 2019-02-16, a malformed GIF file triggers a divide-by-zero exception in the decoder function DGifSlurp in dgif_lib.c if the height field of the ImageSize data structure is equal to zero.

Copyright 2019, cxsecurity.com

 

Back to Top