CVE-2017-1000472

Name	CVE-2017-1000472
Description	The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header, which allows attackers to conduct absolute path traversal attacks during the ZIP decompression, and possibly create or overwrite arbitrary files, via a crafted ZIP file, related to a "file path injection vulnerability".
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1239-1, DSA-4083-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
poco (PTS)	jessie, jessie (lts)	1.3.6p1-5+deb8u1	fixed
	stretch (security), stretch (lts), stretch	1.7.6+dfsg1-5+deb9u1	fixed
	buster	1.9.0-5	fixed
	bullseye	1.10.0-6+deb11u1	fixed
	bookworm	1.11.0-3	fixed
	sid, trixie	1.13.0-6	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
poco	source	wheezy	1.3.6p1-4+deb7u1	DLA-1239-1
poco	source	jessie	1.3.6p1-5+deb8u1	DSA-4083-1
poco	source	stretch	1.7.6+dfsg1-5+deb9u1	DSA-4083-1
poco	source	(unstable)	1.8.0-2

https://github.com/pocoproject/poco/issues/1968