Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 8 Jun 2010 13:33:35 -0600
From: Vincent Danen <>
Cc: "Steven M. Christey" <>
Subject: jar, fastjar directory traversal vulnerabilities

Hi all.

A directory traversal flaw was reported in fastjar [1] that was assigned
CVE-2010-0831.  Upon investigation, it was found that the jar program
[2] had a similar problem.  No CVE name was assigned to the jar issue,
however it looks like they are two different programs with two different
code bases.

There is also some confusion because these issues are similar to (or a
result of incomplete fixes for) CVE-2006-3619 (fastjar) and
CVE-2005-1080 (jar).

What makes things worse is that it doesn't look like CVE-2005-1080 was
ever fixed.  So I'm not sure if this "new" jar issue needs a new CVE
name, or if it would be covered under CVE-2005-1080 (since nothing ever
claimed to fix this directory traversal vulnerability in jar).

Any insight from MITRE would be appreciated.  I've not assigned a CVE
name to the "new" jar issue because of this confusion.

Vincent Danen / Red Hat Security Response Team 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.