perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.

This update for perl-Archive-Zip fixes the following security issue :

  - CVE-2018-10860: Prevent directory traversal caused by     not properly sanitizing paths while extracting zip     files. An attacker able to provide a specially crafted     archive for processing could have used this flaw to     write or overwrite arbitrary files in the context of the     perl interpreter (bsc#1099497)

This update was imported from the SUSE:SLE-15:Update update project.

This release fixes a directory and symbolic link traversal vulnerability in Archive::Zip::Archive Perl module that allows an attacker to writite into an arbitrary file accesible by a local user.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Archive::Zip, a perl module for manipulation of ZIP archives, is prone to a directory traversal vulnerability. An attacker able to provide a specially crafted archive for processing can take advantage of this flaw to overwrite arbitrary files during archive extraction.

This update for perl-Archive-Zip fixes the following security issue :

  - CVE-2018-10860: Prevent directory traversal caused by     not properly sanitizing paths while extracting zip     files. An attacker able to provide a specially crafted     archive for processing could have used this flaw to     write or overwrite arbitrary files in the context of the     perl interpreter (bsc#1099497).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The libarchive-zip-perl package is vulnerable to a directory traversal attack in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the Perl interpreter.

For Debian 8 'Jessie', this problem has been fixed in version 1.39-1+deb8u1.

We recommend that you upgrade your libarchive-zip-perl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Archive Zip module incorrectly handled certain inputs. An attacker could possibly use this to access sensitive information.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
123272	openSUSE Security Update : perl-Archive-Zip (openSUSE-2019-628)	Nessus	SuSE Local Security Checks	high
120499	Fedora 28 : perl-Archive-Zip (2018-6abfa0012f)	Nessus	Fedora Local Security Checks	high
117644	Debian DSA-4300-1 : libarchive-zip-perl - security update	Nessus	Debian Local Security Checks	high
112004	openSUSE Security Update : perl-Archive-Zip (openSUSE-2018-904)	Nessus	SuSE Local Security Checks	high
111840	SUSE SLES11 Security Update : perl-Archive-Zip (SUSE-SU-2018:2388-1)	Nessus	SuSE Local Security Checks	high
111312	Debian DLA-1440-1 : libarchive-zip-perl security update	Nessus	Debian Local Security Checks	high
111248	Fedora 27 : perl-Archive-Zip (2018-ebebe9abe2)	Nessus	Fedora Local Security Checks	high
110925	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Archive Zip (USN-3703-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2018-10860

high

Tenable Plugins

high

high

high

high

high

high

high

high