Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

rubyzip

4 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 1 high
Registry
RubyGems

Advisories 4

  • rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

    Affected: fixed in 3.4.0.

  • In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can…

    Affected: fixed in 1.3.0.

  • rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write…

    Affected: fixed in 1.2.2.

  • The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability.

    Affected: fixed in 1.2.1.