It was discovered that Archive::Zip, a perl module for manipulation of ZIP archives, is prone to a directory traversal vulnerability. An attacker able to provide a specially crafted archive for processing can take advantage of this flaw to overwrite arbitrary files during archive extraction.

This release fixes a directory and symbolic link traversal vulnerability in Archive::Zip::Archive Perl module that allows an attacker to writite into an arbitrary file accesible by a local user.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - perl-Archive-Zip: Directory traversal in Archive::Zip (CVE-2018-10860)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The libarchive-zip-perl package is vulnerable to a directory traversal attack in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the Perl interpreter.

For Debian 8 'Jessie', this problem has been fixed in version 1.39-1+deb8u1.

We recommend that you upgrade your libarchive-zip-perl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3703-1 advisory.

    It was discovered that the Archive Zip module incorrectly handled certain inputs. An attacker could     possibly use this to access sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for perl-Archive-Zip fixes the following security issue :

  - CVE-2018-10860: Prevent directory traversal caused by     not properly sanitizing paths while extracting zip     files. An attacker able to provide a specially crafted     archive for processing could have used this flaw to     write or overwrite arbitrary files in the context of the     perl interpreter (bsc#1099497)

This update was imported from the SUSE:SLE-15:Update update project.

This update for perl-Archive-Zip fixes the following security issue :

  - CVE-2018-10860: Prevent directory traversal caused by     not properly sanitizing paths while extracting zip     files. An attacker able to provide a specially crafted     archive for processing could have used this flaw to     write or overwrite arbitrary files in the context of the     perl interpreter (bsc#1099497).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - perl-Archive-Zip: Directory traversal in Archive::Zip (CVE-2018-10860)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - perl-Archive-Zip: Directory traversal in Archive::Zip (CVE-2018-10860)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
117644	Debian DSA-4300-1 : libarchive-zip-perl - security update	Nessus	Debian Local Security Checks	9/24/2018	8/6/2024	high
120499	Fedora 28 : perl-Archive-Zip (2018-6abfa0012f)	Nessus	Fedora Local Security Checks	1/3/2019	7/5/2024	high
199802	RHEL 7 : perl-archive-zip (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	high
111312	Debian DLA-1440-1 : libarchive-zip-perl security update	Nessus	Debian Local Security Checks	7/25/2018	9/3/2024	high
110925	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Archive Zip (USN-3703-1)	Nessus	Ubuntu Local Security Checks	7/5/2018	8/27/2024	high
111248	Fedora 27 : perl-Archive-Zip (2018-ebebe9abe2)	Nessus	Fedora Local Security Checks	7/24/2018	9/3/2024	high
112004	openSUSE Security Update : perl-Archive-Zip (openSUSE-2018-904)	Nessus	SuSE Local Security Checks	8/20/2018	8/16/2024	high
111840	SUSE SLES11 Security Update : perl-Archive-Zip (SUSE-SU-2018:2388-1)	Nessus	SuSE Local Security Checks	8/17/2018	8/16/2024	high
123272	openSUSE Security Update : perl-Archive-Zip (openSUSE-2019-628)	Nessus	SuSE Local Security Checks	3/27/2019	6/11/2024	high
199698	RHEL 6 : perl-archive-zip (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	high
199720	RHEL 5 : perl-archive-zip (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high