Skip to content
OpenAdvisories
Medium ALAS2-2020-1551 1 CVE

Moderate: zziplib security update (Amazon Linux 2)

Published Oct 22, 2020 · Updated Oct 22, 2020

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-17828: It was discovered that zziplib is vulnerable to a directory traversal flaw in most of its unzip binaries, including unzip-mem, unzzipcat-mem, unzzipcat-big, unzzipcat-mix, and unzzipcat-zip. An attacker may use this flaw to write files outside the intended target directory, overwriting existing files, or creating new ones. 1635888: CVE-2018-17828 zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 zziplib 0:0.13.62-12.amzn2
Amazon Linux · 2 zziplib-debuginfo 0:0.13.62-12.amzn2
Amazon Linux · 2 zziplib-devel 0:0.13.62-12.amzn2
Amazon Linux · 2 zziplib-utils 0:0.13.62-12.amzn2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-17828.html