Threats tagged 'ghsa-q7v9-x93c-xqv3'

A vulnerability in the zip crate (versions >=1.3.0 <9.0.0) allows an attacker to cause an uncatchable process abort during extraction by specifying an unbounded symlink target size. The flaw arises because the symbolic-link extraction code allocates memory based on an attacker-controlled size from the ZIP central directory without bounds checking. This leads to an infallible allocation failure that aborts the process, causing denial of service. The issue is fixed in version 9.0.0.