high7.5

CVE-2018-12015

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, vi…

Impact

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.

Affected products

Vendor	Product	Affected versions
Canonical	Ubuntu Linux	Versions 12.04, 14.04, 16.04, 17.10, 18.04
Debian	Debian Linux	Versions 8.0, 9.0
Perl	Perl	through 5.26.2
Archive\	\	through 2.28
Apple	Mac Os X	before 10.14.4
Netapp	Data Ontap Edge	All versions
Netapp	Oncommand Workflow Automation	All versions
Netapp	Snap Creator Framework	All versions
Netapp	Snapdrive	All versions

Weakness classification

CWE-59

References

NVD record
CVE.org record
http://seclists.org/fulldisclosure/2019/Mar/49
http://www.securityfocus.com/bid/104423
http://www.securitytracker.com/id/1041048
https://access.redhat.com/errata/RHSA-2019:2097
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834
https://seclists.org/bugtraq/2019/Mar/42
https://security.netapp.com/advisory/ntap-20180927-0001/
https://support.apple.com/kb/HT209600
https://usn.ubuntu.com/3684-1/
https://usn.ubuntu.com/3684-2/
https://www.debian.org/security/2018/dsa-4226
https://www.oracle.com/security-alerts/cpujul2020.html
http://seclists.org/fulldisclosure/2019/Mar/49
http://www.securityfocus.com/bid/104423
http://www.securitytracker.com/id/1041048
https://access.redhat.com/errata/RHSA-2019:2097
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834
https://seclists.org/bugtraq/2019/Mar/42
https://security.netapp.com/advisory/ntap-20180927-0001/
https://support.apple.com/kb/HT209600
https://usn.ubuntu.com/3684-1/
https://usn.ubuntu.com/3684-2/
https://www.debian.org/security/2018/dsa-4226
https://www.oracle.com/security-alerts/cpujul2020.html