2 results · Feed
-
Medium 5.3
socket.getaddrinfo() accepts embedded null bytes in host and port
socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.
-
Medium 6.9
tar filter allows writing outside destination via empty-named symlink
tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extracta…