A path traversal vulnerability affects yaffshiv YAFFS filesystem extractor. By crafting a malicious YAFFS file, an attacker could force yaffshiv to write outside of the extraction directory.
This issue affects yaffshiv up to version 0.1 included, which is the most recent at time of publication.
References
| Link | Resource |
|---|---|
| https://github.com/devttys0/yaffshiv/pull/3/files | Patch Third Party Advisory |
| https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/ | Exploit Third Party Advisory |
| https://github.com/devttys0/yaffshiv/pull/3/files | Patch Third Party Advisory |
| https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/ | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 07:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/devttys0/yaffshiv/pull/3/files - Patch, Third Party Advisory | |
| References | () https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/ - Exploit, Third Party Advisory |
07 Nov 2023, 04:00
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A path traversal vulnerability affects yaffshiv YAFFS filesystem extractor. By crafting a malicious YAFFS file, an attacker could force yaffshiv to write outside of the extraction directory. This issue affects yaffshiv up to version 0.1 included, which is the most recent at time of publication. |
Information
Published : 2023-01-31 10:15
Updated : 2024-11-21 07:37
NVD link : CVE-2023-0593
Mitre link : CVE-2023-0593
CVE.ORG link : CVE-2023-0593
JSON object : View
Products Affected
yaffshiv_project
- yaffshiv
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')