kc3-lang/zlib/contrib/minizip/miniunz.c
Branch :
Log
| Author | Commit | Date | CI | Message |
|---|---|---|---|---|
 |
14a5f8f2 | 2024-01-17 14:46:18 | Neutralize zip file traversal attacks in miniunz. Archive formats such as .zip files are generally susceptible to so-called "traversal attacks". This allows an attacker to craft an archive that writes to unexpected locations of the file system (e.g., /etc/shadow) if an unspecting root user were to unpack a malicious archive. This patch neutralizes absolute paths such as /tmp/moo and deeply relative paths such as dummy/../../../../../../../../../../tmp/moo The Debian project requested CVE-2014-9485 be allocated for the first identified weakness. The fix was incomplete, resulting in a revised patch applied here. Since there wasn't an updated version released by Debian with the incomplete fix, I suggest we use this CVE to identify both issues. Link: https://security.snyk.io/research/zip-slip-vulnerability Link: https://bugs.debian.org/774321 Link: https://bugs.debian.org/776831 Link: https://nvd.nist.gov/vuln/detail/CVE-2014-9485 Reported-by: Jakub Wilk <jwilk@debian.org> Fixed-by: Michael Gilbert <mgilbert@debian.org> | |
 |
190168cc | 2023-12-11 11:47:43 | Correct case of MSDOS in contrib/minizip/miniunz.c. | |
 |
88e50f17 | 2016-11-15 21:04:58 | Update miniunz version. | |
 |
25bbd7f5 | 2023-08-17 21:40:28 | Avoid uninitialized and unused warnings in contrib/minizip. | |
 |
aa154e3d | 2023-07-29 11:17:19 | Support Haiku in minizip. | |
 |
379bbda3 | 2023-02-02 16:03:24 | Fix typos found by codespell in minizip | |
|
bf2578be | 2023-04-15 11:16:17 | Remove K&R function definitions from contrib/minizip. | |
 |
4572dfbe | 2022-10-06 17:17:07 | Remove some harmless semicolons in minizip. | |
|
2014a993 | 2022-01-01 14:32:17 | Clean up minizip to reduce warnings for testing. Also fix Makefile test target and permit added compile options. | |
|
0530dbce | 2021-02-10 15:03:22 | Improve portability of contrib/minizip. |