ISOMAN

CVE

CVE-2019-14452

Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.

Severity
HIGH
CVSS
7.5
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu18.04.6 amd64 desktopunknownsource
Ubuntu18.04.6 amd64 live-serverunknownsource
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource

References

  1. https://github.com/Sigil-Ebook/Sigil/commit/04e2f280cc4a0766bedcc7b9eb56449ceecc2ad4
  2. https://github.com/Sigil-Ebook/Sigil/commit/0979ba8d10c96ebca330715bfd4494ea0e019a8f
  3. https://github.com/Sigil-Ebook/Sigil/commit/369eebe936e4a8c83cc54662a3412ce8bef189e4
  4. https://github.com/Sigil-Ebook/Sigil/compare/ea7f27d...5b867e5
  5. https://github.com/Sigil-Ebook/Sigil/releases/tag/0.9.16
  6. https://github.com/Sigil-Ebook/flightcrew/issues/52#issuecomment-505967936
  7. https://github.com/Sigil-Ebook/flightcrew/issues/52#issuecomment-505997355
  8. https://salvatoresecurity.com/zip-slip-in-sigil-cve-2019-14452/
  9. https://usn.ubuntu.com/4085-1/
  10. https://github.com/Sigil-Ebook/Sigil/commit/04e2f280cc4a0766bedcc7b9eb56449ceecc2ad4
  11. https://github.com/Sigil-Ebook/Sigil/commit/0979ba8d10c96ebca330715bfd4494ea0e019a8f
  12. https://github.com/Sigil-Ebook/Sigil/commit/369eebe936e4a8c83cc54662a3412ce8bef189e4
  13. https://github.com/Sigil-Ebook/Sigil/compare/ea7f27d...5b867e5
  14. https://github.com/Sigil-Ebook/Sigil/releases/tag/0.9.16
  15. https://github.com/Sigil-Ebook/flightcrew/issues/52#issuecomment-505967936
  16. https://github.com/Sigil-Ebook/flightcrew/issues/52#issuecomment-505997355
  17. https://salvatoresecurity.com/zip-slip-in-sigil-cve-2019-14452/
  18. https://usn.ubuntu.com/4085-1/