Skip to content
OpenAdvisories
Critical DSA-3801-1 1 CVE

ruby-zip - security update

Published Mar 4, 2017 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 ruby-zip 1.1.6-1+deb8u1

Vulnerabilities 1

  • Critical 9.8
    CVE-2017-5946

    Directory traversal vulnerability in RubyZip

    The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the fil…

    rubyzip ruby-zip ruby-zip Debian Ubuntu RubyGems