CVE-2017-8314 Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.
MediumCVSS 5.5
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/kodi(Debian:12) | < 2:17.1+dfsg1-3 | 2:17.1+dfsg1-3 |
| debian/kodi(Debian:13) | < 2:17.1+dfsg1-3 | 2:17.1+dfsg1-3 |
| debian/kodi(Debian:14) | < 2:17.1+dfsg1-3 | 2:17.1+dfsg1-3 |
| kodi | <= 17.1 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| XBMC Foundation Kodi (XBMC) | = <= v17.1 | No fix listed |
References
- Debian Security Tracker CVE-2017-8314 vendor-advisory
- 98668 third-party-advisory vdb-entry
- github.com patch vendor-advisory
- [debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update mailing-list third-party-advisory
- GLSA-201706-17 third-party-advisory vendor-advisory
- bugs.debian.org issue-tracking