CVE-2018-1002209

Name	CVE-2018-1002209
Description	QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	902786

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libquazip (PTS)	bullseye	0.9.1-1	fixed
	bookworm	0.9.1-3	fixed
	trixie	0.9.1-5	fixed
	forky, sid	0.9.1-6	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libquazip	source	(unstable)	0.7.6-1			902786

[stretch] - libquazip <no-dsa> (Minor issue)
[jessie] - libquazip <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=1593011