Directory traversal vulnerability in the extract_jar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in a non-initial pathname component in a filename within a .jar archive, a related issue to CVE-2005-1080. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-3619.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade fastjar | Jul 30, 2024 | Jun 18, 2010 |
| Gentoo Linux | — | Upgrade app-arch/fastjar. | Oct 30, 2017 | Jun 18, 2010 |
| Oracle_linux | — | Upgrade libmudflap-staticUpgrade gcc-gnatUpgrade gcc-gfortranUpgrade gcc-c++Upgrade libgcjUpgrade libgfortran-staticUpgrade libquadmath-staticUpgrade libitm-staticUpgrade cppUpgrade gccUpgrade libstdc++Upgrade libgcj-develUpgrade gcc-objcUpgrade libatomic-staticUpgrade libmudflapUpgrade gcc-javaUpgrade libgcc | Oct 16, 2024 | Jun 18, 2010 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 6, 2010 |
| Suse | — | Upgrade fastjar | Dec 12, 2013 | May 6, 2013 |
| Ubuntu | — | Upgrade fastjar | Nov 8, 2024 | Jun 18, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub