Vulnerabilities

TI-2023-09041 CVE-2023-22899 · GHSA-2pj2-gchf-wmw7

Zip4j through 2.11.2, as used in Threema and other products, does not always check the…

MEDIUM 60

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00642 Published 2023-01-10 Partial fix · 2.11.3 CWE-346

TI-2022-08457 CVE-2022-24615 · GHSA-q62h-jw38-24vh

zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially…

LOW 26

zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00709 Published 2022-02-24 Fixed in 2.10.0 CWE-755

TI-2018-16134 CVE-2018-1002202 · GHSA-2rpm-4x8c-pvqg

Path traversal in zip4j

MEDIUM 43

zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.12642 Published 2018-07-25 Fixed in 1.3.3 CWE-22

Vulnerabilities

Filters

Zip4j through 2.11.2, as used in Threema and other products, does not always check the…

zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially…

Path traversal in zip4j