fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade node-fstream | Jul 30, 2024 | Jul 2, 2019 |
| Suse | — | Upgrade firefox-libffi4Upgrade firefox-gio-branding-upstreamUpgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nssUpgrade firefox-atk-langUpgrade nodejs6-develUpgrade libsoftokn3-32bitUpgrade npm8Upgrade libfirefox-gmodule-2_0-0Upgrade nodejs6Upgrade MozillaFirefox-translations-commonUpgrade nodejs10-develUpgrade libfirefox-glib-2_0-0Upgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-dataUpgrade firefox-gtk3-langUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gdk-pixbuf-query-loadersUpgrade npm6Upgrade mozilla-nspr-develUpgrade libfirefox-gthread-2_0-0Upgrade firefox-libcairo2Upgrade nodejs4Upgrade firefox-gtk3-immodule-ximUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gdk-pixbuf-langUpgrade firefox-libffi7Upgrade npm10Upgrade npm12Upgrade firefox-libgtk-3-0Upgrade nodejs8Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade nodejs8-develUpgrade firefox-libatk-1_0-0Upgrade libfreebl3-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-libharfbuzz0Upgrade nodejs12-develUpgrade mozilla-nss-develUpgrade mozilla-nsprUpgrade mozilla-nss-32bitUpgrade firefox-libpango-1_0-0Upgrade mozilla-nss-toolsUpgrade MozillaFirefoxUpgrade nodejs12-docsUpgrade nodejs4-develUpgrade firefox-glib2-toolsUpgrade nodejs12Upgrade mozilla-nss-certsUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs6-docsUpgrade mozilla-nspr-32bitUpgrade libfreebl3Upgrade firefox-gtk3-immodule-multipressUpgrade libfirefox-gio-2_0-0Upgrade nodejs10-docsUpgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-immodule-vietnameseUpgrade MozillaFirefox-translations-otherUpgrade firefox-gtk3-toolsUpgrade nodejs10Upgrade nodejs4-docsUpgrade nodejs8-docsUpgrade firefox-gtk3-immodule-thaiUpgrade npm4Upgrade firefox-glib2-langUpgrade libsoftokn3 | Aug 13, 2019 | Jul 2, 2019 |
| Ubuntu | — | Upgrade node-fstreamUpgrade node-fstream (Ubuntu Pro) | Sep 6, 2019 | Jul 2, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub