fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade node-fstream | Jul 30, 2024 | Jul 2, 2019 |
| Suse | — | Upgrade firefox-atk-langUpgrade firefox-gtk3-immodule-amharicUpgrade npm12Upgrade libfirefox-glib-2_0-0Upgrade firefox-gtk3-immodules-tigrignaUpgrade npm10Upgrade MozillaFirefox-branding-SLEDUpgrade firefox-libffi4Upgrade npm6Upgrade libfirefox-gthread-2_0-0Upgrade firefox-libcairo-gobject2Upgrade nodejs10-develUpgrade firefox-libcairo2Upgrade nodejs6Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-langUpgrade firefox-libgtk-3-0Upgrade libfirefox-gobject-2_0-0Upgrade mozilla-nssUpgrade nodejs4Upgrade firefox-gio-branding-upstreamUpgrade npm8Upgrade nodejs6-develUpgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-libffi7Upgrade mozilla-nspr-develUpgrade MozillaFirefox-translations-commonUpgrade firefox-gtk3-dataUpgrade libsoftokn3-32bitUpgrade nodejs8-develUpgrade nodejs12-develUpgrade nodejs8-docsUpgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-immodule-inuktitutUpgrade nodejs10-docsUpgrade libfirefox-gio-2_0-0Upgrade mozilla-nss-32bitUpgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-libharfbuzz0Upgrade libfreebl3-32bitUpgrade MozillaFirefox-translations-otherUpgrade firefox-gtk3-toolsUpgrade nodejs10Upgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs4-docsUpgrade libfreebl3Upgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodule-multipressUpgrade nodejs6-docsUpgrade libsoftokn3Upgrade firefox-libatk-1_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade MozillaFirefoxUpgrade npm4Upgrade mozilla-nss-toolsUpgrade mozilla-nss-develUpgrade nodejs8Upgrade nodejs4-develUpgrade firefox-glib2-langUpgrade firefox-glib2-toolsUpgrade mozilla-nss-certsUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs12-docsUpgrade nodejs12Upgrade mozilla-nspr | Aug 13, 2019 | Jul 2, 2019 |
| Ubuntu | — | Upgrade node-fstream (Ubuntu Pro)Upgrade node-fstream | Sep 6, 2019 | Jul 2, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub