Most recent entries from all

bdu:2019-02828

certfr-2024-avi-0575 — De multiples vulnérabilités ont été découvertes dans les produits Juniper Networks. Certaines d'entre elles permettent…

certfr-2024-avi-0575

EUVD-2026-70451

fkie_cve-2018-20834

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).

GHSA-j44m-qm6p-hp7m — Arbitrary File Overwrite in tar

Affected: npm: tar

Versions of `tar` prior to 4.4.2 for 4.x and 2.2.2 for 2.x are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.

## Recommendation

For tar 4.x, upgrade to version 4.4.2 or later. For tar 2.x, upgrade to version 2.2.2 or later.

gsd-2018-20834

RHSA-2019:1821 — Red Hat Security Advisory: rh-nodejs8-nodejs security update

nodejs: HTTP request splitting nodejs: Denial of Service with large HTTP headers nodejs: Slowloris HTTP Denial of Service nodejs: Hostname spoofing in URL parser for javascript protocol nodejs-tar: Arbitrary file overwrites when extracting tarballs containing a hard-link nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass

WID-SEC-W-2023-2535 — Red Hat rh-nodejs8-nodejs: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat rh-nodejs8-nodejs ausnutzen, um Dateien zu manipulieren.