CVE-2019-13241

Description

FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.

References

https://usn.ubuntu.com/4055-1/

https://salvatoresecurity.com/fun-with-fuzzers-how-i-discovered-three-vulnerabilities-part-3-of-3/

https://github.com/Sigil-Ebook/flightcrew/issues/52

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3