CVE-2019-14452

moderate-risk

Published 2019-07-31

Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.

Do I need to act?

3.0% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (5)

Sigil

Flightcrew

Ubuntu Linux

Affected Vendors

Canonical Flightcrew Project Sigil-Ebook

References (18)

Patch https://github.com/Sigil-Ebook/Sigil/commit/04e2f280cc4a0766bedcc7b9eb56449ceecc...

Patch https://github.com/Sigil-Ebook/Sigil/commit/0979ba8d10c96ebca330715bfd4494ea0e01...

Patch https://github.com/Sigil-Ebook/Sigil/commit/369eebe936e4a8c83cc54662a3412ce8bef1...

Third Party Advisory https://github.com/Sigil-Ebook/Sigil/compare/ea7f27d...5b867e5

Release Notes https://github.com/Sigil-Ebook/Sigil/releases/tag/0.9.16

Third Party Advisory https://github.com/Sigil-Ebook/flightcrew/issues/52#issuecomment-505967936

Third Party Advisory https://github.com/Sigil-Ebook/flightcrew/issues/52#issuecomment-505997355

https://salvatoresecurity.com/zip-slip-in-sigil-cve-2019-14452/

Third Party Advisory https://usn.ubuntu.com/4085-1/