Filtered by vendor Rubyzip Project Subscriptions
Filtered by product Rubyzip Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-16892 3 Fedoraproject, Redhat, Rubyzip Project 3 Fedora, Cloudforms, Rubyzip 2023-12-28 5.5 Medium
In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).
CVE-2018-1000544 3 Debian, Redhat, Rubyzip Project 3 Debian Linux, Cloudforms, Rubyzip 2020-08-24 9.8 Critical
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem..
CVE-2017-5946 2 Debian, Rubyzip Project 2 Debian Linux, Rubyzip 2020-05-14 9.8 Critical
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.