Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade zziplib-utilsUpgrade zziplib-develUpgrade zziplib | May 4, 2022 | Oct 1, 2018 |
| Alpine Linux | — | Upgrade zziplib | Nov 27, 2019 | Oct 1, 2018 |
| Amazon Linux Ami 2 | — | Upgrade zziplib-utilsUpgrade zziplib-develUpgrade zziplib-debuginfoUpgrade zziplib | Oct 28, 2020 | Oct 1, 2018 |
| Centos_linux | — | Upgrade zziplib-develUpgrade zziplib-utilsUpgrade zziplibUpgrade zziplib-debugsourceUpgrade zziplib-debuginfoUpgrade zziplib-utils-debuginfo | Apr 1, 2020 | Oct 1, 2018 |
| Debian | — | No solution exists | May 15, 2025 | Oct 1, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade zziplib | Nov 19, 2019 | Oct 1, 2018 |
| Oracle_linux | — | Upgrade zziplibUpgrade zziplib-utilsUpgrade zziplib-devel | Oct 5, 2022 | Sep 25, 2018 |
| Redhat_linux | — | Upgrade zziplibUpgrade zziplib-utils-debuginfoUpgrade zziplib-debugsourceUpgrade zziplib-utilsUpgrade zziplib-debuginfoUpgrade zziplib-devel | Apr 1, 2020 | Oct 1, 2018 |
| Rocky_linux | — | Upgrade zziplibUpgrade zziplib-utils-debuginfoUpgrade zziplib-debuginfoUpgrade zziplib-develUpgrade zziplib-debugsourceUpgrade zziplib-utils | Mar 12, 2024 | Oct 1, 2018 |
| Suse | — | Upgrade libzzip-0-13Upgrade libzzip-0-13-32bitUpgrade zziplib-devel-32bitUpgrade zziplib-devel | Oct 24, 2018 | Oct 1, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Oct 1, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub