Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-17828: It was discovered that zziplib is vulnerable to a directory traversal flaw in most of its unzip binaries, including unzip-mem, unzzipcat-mem, unzzipcat-big, unzzipcat-mix, and unzzipcat-zip. An attacker may use this flaw to write files outside the intended target directory, overwriting existing files, or creating new ones. 1635888: CVE-2018-17828 zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | zziplib | 0:0.13.62-12.amzn2 |
| Amazon Linux · 2 | zziplib-debuginfo | 0:0.13.62-12.amzn2 |
| Amazon Linux · 2 | zziplib-devel | 0:0.13.62-12.amzn2 |
| Amazon Linux · 2 | zziplib-utils | 0:0.13.62-12.amzn2 |
Vulnerabilities 1
-
Unscored —
Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) i…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-17828.html