perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - perl-Archive-Zip: Directory traversal in Archive::Zip (CVE-2018-10860)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - perl-Archive-Zip: Directory traversal in Archive::Zip (CVE-2018-10860)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - perl-Archive-Zip: Directory traversal in Archive::Zip (CVE-2018-10860)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This update for perl-Archive-Zip fixes the following security issue :

  - CVE-2018-10860: Prevent directory traversal caused by     not properly sanitizing paths while extracting zip     files. An attacker able to provide a specially crafted     archive for processing could have used this flaw to     write or overwrite arbitrary files in the context of the     perl interpreter (bsc#1099497)

This update was imported from the SUSE:SLE-15:Update update project.

This release fixes a directory and symbolic link traversal vulnerability in Archive::Zip::Archive Perl module that allows an attacker to writite into an arbitrary file accesible by a local user.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Archive::Zip, a perl module for manipulation of ZIP archives, is prone to a directory traversal vulnerability. An attacker able to provide a specially crafted archive for processing can take advantage of this flaw to overwrite arbitrary files during archive extraction.

This update for perl-Archive-Zip fixes the following security issue :

  - CVE-2018-10860: Prevent directory traversal caused by     not properly sanitizing paths while extracting zip     files. An attacker able to provide a specially crafted     archive for processing could have used this flaw to     write or overwrite arbitrary files in the context of the     perl interpreter (bsc#1099497).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The libarchive-zip-perl package is vulnerable to a directory traversal attack in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the Perl interpreter.

For Debian 8 'Jessie', this problem has been fixed in version 1.39-1+deb8u1.

We recommend that you upgrade your libarchive-zip-perl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3703-1 advisory.

    It was discovered that the Archive Zip module incorrectly handled certain inputs. An attacker could     possibly use this to access sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199802	RHEL 7 : perl-archive-zip (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199720	RHEL 5 : perl-archive-zip (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199698	RHEL 6 : perl-archive-zip (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
123272	openSUSE Security Update : perl-Archive-Zip (openSUSE-2019-628)	Nessus	SuSE Local Security Checks	high
120499	Fedora 28 : perl-Archive-Zip (2018-6abfa0012f)	Nessus	Fedora Local Security Checks	high
117644	Debian DSA-4300-1 : libarchive-zip-perl - security update	Nessus	Debian Local Security Checks	high
112004	openSUSE Security Update : perl-Archive-Zip (openSUSE-2018-904)	Nessus	SuSE Local Security Checks	high
111840	SUSE SLES11 Security Update : perl-Archive-Zip (SUSE-SU-2018:2388-1)	Nessus	SuSE Local Security Checks	high
111312	Debian DLA-1440-1 : libarchive-zip-perl security update	Nessus	Debian Local Security Checks	high
111248	Fedora 27 : perl-Archive-Zip (2018-ebebe9abe2)	Nessus	Fedora Local Security Checks	high
110925	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Archive Zip (USN-3703-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2018-10860

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high