Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

net.lingala.zip4j:zip4j

3 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 1 medium
Registry
Maven Central

Advisories 3

  • CVE-2023-22899Medium 5.9

    Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.

    Affected: fixed in 2.11.3.

  • zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application…

    Affected: fixed in 2.10.0.

  • zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip…

    Affected: fixed in 1.3.3.