id: PYSEC-2018-83
details: diffoscope before 77 writes to arbitrary locations on disk based on the contents
  of an untrusted archive.
affected:
- package:
    name: diffoscope
    ecosystem: PyPI
    purl: pkg:pypi/diffoscope
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: '77'
  versions:
  - '39'
  - '40'
  - '41'
  - '42'
  - '43'
  - '44'
  - '45'
  - '46'
  - '47'
  - '48'
  - '49'
  - '51'
  - '52'
  - '54'
  - '55'
  - '56'
  - '59'
  - '60'
  - '61'
  - '62'
  - '63'
  - '64'
  - '65'
  - '66'
  - '67'
  - '68'
  - '69'
  - '70'
  - '71'
  - '72'
  - '73'
  - '74'
  - '75'
  - '76'
references:
- type: WEB
  url: https://security-tracker.debian.org/tracker/CVE-2017-0359
- type: WEB
  url: https://bugs.debian.org/854723
- type: ADVISORY
  url: https://github.com/advisories/GHSA-8p5c-f328-9fvv
aliases:
- CVE-2017-0359
- GHSA-8p5c-f328-9fvv
modified: '2021-08-27T03:21:57.266779Z'
published: '2018-04-13T16:29:00Z'