{"id":"CVE-2010-2322","published":"2010-06-18T18:00:00Z","modified":"2024-08-07T02:32:16Z","title":"Absolute path traversal vulnerability in the extract_jar function in jartool.c in FastJar 0.98 allows remote attackers…","vendor":null,"product":null,"tier":"tail","description":{"text":"Absolute path traversal vulnerability in the extract_jar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via a full pathname for a file within a .jar archive, a related issue to CVE-2010-0831.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-3619.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03234,"percentile":0.88222,"provenance":"source"},"cwes":[],"references":[{"url":"http://security.gentoo.org/glsa/glsa-201209-21.xml","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=594497","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=oss-security&m=127602564508766&w=2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-0025.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=601823","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/41009","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.vupen.com/english/advisories/2011/0121","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://packages.debian.org/changelogs/pool/main/f/fastjar/fastjar_0.98-3/changelog","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/42892","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/50786","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://launchpad.net/bugs/540575","tags":["x_refsource_CONFIRM"]},{"url":"http://www.osvdb.org/65467","tags":["vdb-entry","x_refsource_OSVDB"]}],"priority":{"score":17.6,"factors":[{"name":"EPSS percentile","points":17.64}]},"euvd":{"id":"EUVD-2010-2332","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-cve-2006-3619-family-cve-2006-3619","parents":[{"from":"CVE-2006-3619","to":"CVE-2010-2322","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-3619.","from":"CVE.org","in":"CVE-2010-2322"}]},{"from":"CVE-2010-0831","to":"CVE-2010-2322","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"…e path traversal vulnerability in the extract_jar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via a full pathname for a file within a .jar archive, a related issue to CVE-2010-0831.","from":"CVE.org","in":"CVE-2010-2322"}]}]}}