CVE-2018-10860

HIGH7.5EPSS 5.7%

libarchive-zip-perl - security update

發布日:2018/6/29修改日:2026/4/28

也稱為:DSA-4300-1DEBIAN-CVE-2018-10860

描述

perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.

受影響套件(3)

Debian/libarchive-zip-perlfrom 0, < 1.62-1
Debian/libarchive-zip-perlfrom 0, < 1.39-1+deb8u1
Debian/libarchive-zip-perlfrom 0, < 1.59-1+deb9u1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

參考連結(1)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2018-10860