[ GLSA 200506-03 ] Dzip: Directory traversal vulnerability

[GLSA]

Gentoo Linux Security Advisory

Title: Dzip: Directory traversal vulnerability (GLSA 200506-03)
Severity: normal
Exploitable: remote
Date: June 06, 2005
Updated: May 22, 2006
Bug(s): #93079
ID: 200506-03

Synopsis

Dzip is vulnerable to a directory traversal attack.

Background

Dzip is a compressor and uncompressor especially made for demo recordings of id's Quake.

Affected Packages

Package: games-util/dzip
Vulnerable: < 2.9-r1
Unaffected: >= 2.9-r1
Architectures: All supported architectures


Description

Dzip is vulnerable to a directory traversal attack when extracting archives.

Impact

An attacker could exploit this vulnerability by creating a specially crafted archive to extract files to arbitrary locations.

Workaround

There is no known workaround at this time.

Resolution

All Dzip users should upgrade to the latest available version: