Directory traversal vulnerability in the extract_jar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in a non-initial pathname component in a filename within a .jar archive, a related issue to CVE-2005-1080. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-3619.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade fastjar | Jul 30, 2024 | Jun 18, 2010 |
| Gentoo Linux | — | Upgrade app-arch/fastjar. | Oct 30, 2017 | Jun 18, 2010 |
| Oracle_linux | — | Upgrade libatomic-staticUpgrade libitm-staticUpgrade libstdc++Upgrade libgcj-develUpgrade libgccUpgrade gccUpgrade cppUpgrade gcc-objcUpgrade libmudflapUpgrade libquadmath-staticUpgrade gcc-javaUpgrade libmudflap-staticUpgrade libgcjUpgrade gcc-c++Upgrade gcc-gnatUpgrade gcc-gfortranUpgrade libgfortran-static | Oct 16, 2024 | Jun 18, 2010 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 6, 2010 |
| Suse | — | Upgrade sle-sdk-releaseUpgrade fastjar | Dec 12, 2013 | Jun 18, 2010 |
| Ubuntu | — | Upgrade fastjar | Nov 8, 2024 | Jun 18, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub