Jelmer

Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.

Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter. apply index filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter branch, enabling code execution by writing into .git/hooks.

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.

**Name of the Vulnerable Software and Affected Versions** aiohttp versions prior to 3.7.4 **Description** The issue is related to an open redirect vulnerability in the aiohttp library, which can allow a remote attacker to conduct phishing attacks using a specially crafted link. This vulnerability is caused by a bug in the `aiohttp.web middlewares.normalize path middleware` middleware. **Recommendations** For versions prior to 3.7.4, upgrade your dependency using pip as follows: "pip install aiohttp >= 3.7.4". If upgrading is not an option, a workaround can be to avoid using `aiohttp.web middlewares.normalize path middleware` in your applications.

**Name of the Vulnerable Software and Affected Versions** Microsoft cabarc (affected versions not specified) **Description** A directory traversal issue exists in Microsoft cabarc, allowing remote attackers to overwrite files by using "../" sequences in file names within a CAB archive. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Internet Explorer version 6 **Description** The issue allows remote attackers to execute arbitrary code in the Local Security context. This can be achieved by using the `showModalDialog` method and modifying the location to execute code, such as Javascript. The exploitation can occur through delayed HTTP redirect operations or by modifying the `location` attribute of the `window` object. **Recommendations** For Internet Explorer version 6, consider disabling the `showModalDialog` method as a temporary workaround until a patch is available. Restrict access to the `MSHTML` engine to minimize the risk of exploitation. Avoid using the `location` attribute of the `window` object in affected scenarios until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Internet Explorer versions 5.01 through 6 SP1 **Description** The issue allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object. **Recommendations** For versions 5.01 through 6 SP1, update to a newer version to mitigate the risk.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Media Player 9 Series (affected versions not specified) Description: The issue allows remote attackers to view and manipulate the Media Library on the local system via HTML script. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Media Player version 7.1 Windows Media Player for Windows XP Description: A directory traversal issue allows remote attackers to execute arbitrary code via a skins file with a URL containing hex-encoded backslash characters (%5C) that causes an executable to be placed in an arbitrary location. Recommendations: For Windows Media Player version 7.1, consider disabling the skins feature until a patch is available. For Windows Media Player for Windows XP, restrict access to skins files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer versions 5.01 through 6.0 **Description** The issue allows remote attackers to automatically upload files from the local system via a web page containing a script to upload the files. This is due to a problem in the file upload control. **Recommendations** For Microsoft Internet Explorer versions 5.01 through 6.0, consider disabling the file upload control as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** UnZip version 5.50 tar-1.13.25 **Description** The issue concerns a directory traversal vulnerability in UnZip, allowing attackers to overwrite arbitrary files by exploiting invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence. Additionally, there are multiple vulnerabilities in the tar package of Red Hat Linux that can lead to a breach of protected information integrity, and these can be exploited remotely. **Recommendations** For UnZip version 5.50, consider restricting access to the vulnerable `UnZip` module to minimize the risk of exploitation until a patch is available. For tar-1.13.25, at the moment, there is no information about a newer version that contains a fix for this vulnerability.