Rubyzip Project

Rubyzip

3 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.1

CVE-2019-16892

Exploit
  • EPSS 0.24%
  • Published 25.09.2019 22:15:10
  • Last modified 21.11.2024 04:31:17

In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

9.8

CVE-2018-1000544

Exploit
  • EPSS 0.34%
  • Published 26.06.2018 16:29:02
  • Last modified 21.11.2024 03:40:09

rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip ...

9.8

CVE-2017-5946

  • EPSS 5.92%
  • Published 27.02.2017 07:59:00
  • Last modified 20.04.2025 01:37:25

The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files t...