Non notée
CVE-2018-1324 A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field…
Description
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Commons Compress | Versions non publiées |
Références
- 1040549 www.securitytracker.com
- [dev] 20180316 [CVE-2018-1324] Apache Commons Compress denial of service vulnerability lists.apache.org
- 103490 www.securityfocus.com
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 lists.apache.org
- [creadur-dev] 20190530 [Discuss] RAT-244 - update to language level 1.7 due to CVE issues in RAT lists.apache.org
- [beam-issues] 20200421 [jira] [Closed] (BEAM-3873) Current version of commons-compress is DOS vulnerable CVE-2018-1324 lists.apache.org
- www.oracle.com www.oracle.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Commons Compress
Les 10 CVE de Apache Commons Compress →
CVE-2024-25710
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects…
8.1
Élevée
CVE-2024-26308
Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects…
Non notée
CVE-2023-42503
Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR…
Non notée
CVE-2021-36090
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally…
Non notée