p PatchFirst

CVE-2018-1002208

CVE-2018-1002208

This page contains facts from public vulnerability sources. Check the original advisory before updating.

SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

CVSS 5.5 · Medium · EPSS 9.9% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • sharpziplib

    Versions
    • < 1.0 RC1: Affected

    No fix published

  • mono Debian:12

    Affected ranges
    • ECOSYSTEM: < 5.18.0.240+dfsg-1

    Update to 5.18.0.240+dfsg-1

  • mono Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.18.0.240+dfsg-1

    Update to 5.18.0.240+dfsg-1

  • mono Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.18.0.240+dfsg-1

    Update to 5.18.0.240+dfsg-1

  • mono Ubuntu:14.04:LTS

    Versions
    • 2.10.8.1-5ubuntu2
    • 3.2.3+dfsg-5
    • 3.2.3+dfsg-7ubuntu1
    • 3.2.8+dfsg-4ubuntu1
    • 3.2.8+dfsg-4ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mono Ubuntu:16.04:LTS

    Versions
    • 3.2.8+dfsg-4ubuntu4
    • 4.2.1.102+dfsg2-5ubuntu1
    • 4.2.1.102+dfsg2-7ubuntu4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mono-reference-assemblies Ubuntu:16.04:LTS

    Versions
    • 3.12.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mono Ubuntu:18.04:LTS

    Versions
    • 4.6.2.7+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mono-reference-assemblies Ubuntu:18.04:LTS

    Versions
    • 3.12.1+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →