CVE-2018-10860
Publication date 29 June 2018
Last updated 25 August 2025
Ubuntu priority
Description
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libarchive-zip-perl | 18.04 LTS bionic |
Fixed 1.60-1ubuntu0.1
|
| 16.04 LTS xenial |
Fixed 1.56-2ubuntu0.1
|
|
| 14.04 LTS trusty |
Fixed 1.30-7ubuntu0.1
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.5 · High
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | High |
| Availability impact | None |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-3703-1
- Archive Zip
- 4 July 2018
- USN-3703-2
- Archive Zip vulnerability
- 4 July 2018