Description

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

Remediation

References

CVE-2007-4559

Related Vulnerabilities

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-4408)

WordPress Plugin User Avatar TimThumb Arbitrary File Upload (1.3.7)

ownCloud Improper Input Validation Vulnerability (CVE-2013-1939)

Joomla! Core 3.x.x Cross-Site Request Forgery (3.2.0 - 3.4.1)

Joomla! Core 3.x.x Cross-Site Scripting (3.1.2 - 3.2.2)

Severity

Medium

Classification

CVE-2007-4559 CWE-22

Tags

Missing Update Known Vulnerabilities