SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry `../evil.txt` may be extracted in the parent directory of `destFolder`. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade mono-data-sqliteUpgrade mono-develUpgrade mono-coreUpgrade mono-extrasUpgrade mono-webUpgrade mono-wcfUpgrade mono-dataUpgrade ibm-data-db2Upgrade mono-reactive-winformsUpgrade monodoc-develUpgrade mono-mvc-develUpgrade mono-locale-extrasUpgrade mono-debuginfoUpgrade mono-winfxUpgrade mono-winformsUpgrade mono-data-oracleUpgrade monodocUpgrade mono-reactive-develUpgrade mono-web-develUpgrade mono-reactiveUpgrade mono-mvcUpgrade mono-complete | Sep 28, 2023 | Jan 26, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub