Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
yauzl 3.2.0 - Denial of Service via Off-by-One Error in NTFS Timestamp Parser
Vulnerability Description
yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Vulnerability Type
Off-by-one错误
Vulnerability Title
yauzl 安全漏洞
Vulnerability Description
yauzl是Josh Wolfe个人开发者的一个Node.js解压缩库。 yauzl 3.2.0版本存在安全漏洞，该漏洞源于NTFS扩展时间戳解析器存在差一错误，可能导致处理特制zip文件时拒绝服务。
CVSS Information
N/A
Vulnerability Type
N/A