Package Instance

Path Traversal
The gem rubyzip contains a Directory Traversal vulnerability in `Zip::File` component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of `.zip` files, an attacker can upload a malicious file that contains symlinks or files with absolute pathnames `..` to write arbitrary files to the filesystem.

Denial of Service in rubyzip ("zip bombs")
In Rubyzip before 1.3.0, a crafted ZIP file can bypass application
checks on ZIP entry sizes because data about the uncompressed size
can be spoofed. This allows attackers to cause a denial of service
(disk consumption).

Directory traversal vulnerability
The `Zip::File` component in the rubyzip gem for Ruby has a directory traversal vulnerability. If a site allows uploading of `.zip` files, an attacker can upload a malicious file that uses `../` pathname substrings to write arbitrary files to the filesystem.