fastjar vulnerability

2010-06-2100:00:00

ubuntu.com

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

AI Score

6.4

Confidence

Low

EPSS

0.009

Percentile

82.6%

JSON

Releases

Ubuntu 10.04
Ubuntu 9.10
Ubuntu 9.04
Ubuntu 8.04

Packages

fastjar -

Details

Dan Rosenberg discovered that fastjar incorrectly handled file paths
containing “…” when unpacking archives. If a user or an automated system
were tricked into unpacking a specially crafted jar file, arbitrary files
could be overwritten with user privileges.

OSVersionArchitecturePackageVersionFilename
Ubuntu9.10noarchfastjar< 2:0.98-1ubuntu0.9.10.1UNKNOWN
Ubuntu9.04noarchfastjar< 2:0.97-3ubuntu0.1UNKNOWN
Ubuntu8.04noarchfastjar< 2:0.95-1ubuntu2.1UNKNOWN
Ubuntu10.04noarchfastjar< 2:0.98-1ubuntu0.10.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	9.10	noarch	fastjar	< 2:0.98-1ubuntu0.9.10.1	UNKNOWN
Ubuntu	9.04	noarch	fastjar	< 2:0.97-3ubuntu0.1	UNKNOWN
Ubuntu	8.04	noarch	fastjar	< 2:0.95-1ubuntu2.1	UNKNOWN
Ubuntu	10.04	noarch	fastjar	< 2:0.98-1ubuntu0.10.04.1	UNKNOWN