Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.

Pigz, a multi-threaded implementation of gzip, was updated to fix one vulnerability.

The following vulnerability was fixed :

  - A crafted file could have caused an unwanted directory     traversal on extract (CVE-2015-1191)

Pigz, a multi-threaded implementation of gzip, was updated to fix one vulnerability.

The following vulnerability was fixed :

  - A crafted file could have caused an unwanted directory     traversal on extract (CVE-2015-1191)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 2.3.3, fixes CVE-2015-1191 :

  - Return zero exit code when only warnings are issued

    - Increase speed of unlzw (Unix compress decompression)

    - Update zopfli to current google state

    - Allow larger maximum blocksize (-b), now 512 MiB

    - Do not require that -d precede -N, -n, -T options

    - Strip any path from header name for -dN or -dNT

    - Remove use of PATH_MAX (PATH_MAX is not reliable)

    - Do not abort on inflate data error, do remaining files

    - Check gzip header CRC if present

    - Improve decompression error detection and reporting

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
89717	openSUSE Security Update : pigz (openSUSE-2016-303)	Nessus	SuSE Local Security Checks	medium
89714	openSUSE Security Update : pigz (openSUSE-2016-299)	Nessus	SuSE Local Security Checks	medium
83712	SUSE SLED12 / SLES12 Security Update : pigz (SUSE-SU-2015:0670-1)	Nessus	SuSE Local Security Checks	medium
82506	Amazon Linux AMI : pigz (ALAS-2015-499)	Nessus	Amazon Linux Local Security Checks	medium
81351	Fedora 20 : pigz-2.3.3-1.fc20 (2015-1510)	Nessus	Fedora Local Security Checks	medium
81350	Fedora 21 : pigz-2.3.3-1.fc21 (2015-1488)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2015-1191

high

Tenable Plugins

medium

medium

medium

medium

medium

medium