Vulnerability Bulletins |
DSA-4255 ant - security update |
|
| Affected software | Debian |
|
Danny Grander reported that the unzip and untar tasks in ant, a Javabased build tool like make, allow the extraction of files outside atarget directory. An attacker can take advantage of this flaw bysubmitting a specially crafted Zip or Tar archive to an ant build tooverwrite any file writable by the user running ant. More info: https://www.debian.org/security/2018/dsa-4255 |
|