Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sun, 18 Jan 2015 14:55:31 -0500 (EST)
To: Thijs Kinkhorst <>
Subject: Re: CVE request: pigz, kgb, pax: directory traversal

On Mon, 12 Jan 2015, Thijs Kinkhorst wrote:

> Three additional cases of directory traversal in archiving utilities 
> have been reported to Debian. Please assign a CVE id to each.
> - pigz
>  Report:
>  Fix:

Use CVE-2015-1191.

> - kgb
>  Report:

Use CVE-2015-1192.

> - pax
>  Report: and

Use CVE-2015-1193 for the .. path traversal (CWE-22).

Use CVE-2015-1194 for the symlink following, which can allow access 
outside of the current directory.

CVE distinguishes symlink following from path traversal as different 
vulnerability types.  The fix for one issue is not necessarily guaranteed 
to fix the other.  Also, since symlink following attacks can often be used 
against protected files within a directory that is already accessible to 
the attacker, it might cause confusion to use the "directory traversal" 
term to describe them.


CVE assignment team, MITRE CVE Numbering Authority M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through ]

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.