CVE-2019-14452
Publication date 30 July 2019
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
From the Ubuntu Security Team
Mike Salvatore discovered that Sigil mishandled certain malformed EPUB files. An attacker could use this vulnerability to write arbitrary files to the filesystem.
Status
Package | Ubuntu Release | Status |
---|---|---|
sigil | ||
18.04 LTS bionic |
Fixed 0.9.9+dfsg-1ubuntu0.1~esm1
|
|
16.04 LTS xenial |
Fixed 0.9.5+dfsg-0ubuntu1+esm1
|
|
14.04 LTS trusty | Not in release |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.5 · High |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | High |
Availability impact | None |
Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-4085-1
- Sigil vulnerability
- 1 August 2019
Other references
- https://github.com/Sigil-Ebook/flightcrew/issues/52#issuecomment-505967936
- https://github.com/Sigil-Ebook/flightcrew/issues/52#issuecomment-505997355
- https://github.com/Sigil-Ebook/Sigil/commit/04e2f280cc4a0766bedcc7b9eb56449ceecc2ad4
- https://github.com/Sigil-Ebook/Sigil/commit/0979ba8d10c96ebca330715bfd4494ea0e019a8f
- https://github.com/Sigil-Ebook/Sigil/commit/369eebe936e4a8c83cc54662a3412ce8bef189e4
- https://github.com/Sigil-Ebook/Sigil/compare/ea7f27d...5b867e5
- https://github.com/Sigil-Ebook/Sigil/releases/tag/0.9.16
- https://www.cve.org/CVERecord?id=CVE-2019-14452