CVE-2017-0359: diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archive
Published Feb 9, 2017
·Updated
diffoscope before 76 writes to arbitrary locations on disk based on the contents of an untrusted archive.
Other sources
diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.
Affected Software
4 affected componentsFixes available
pip/diffoscope<76
76
Reproducible Builds Diffoscope<77
Debian Debian Linux=9.0
debian/diffoscope
177240+deb12u1297+deb13u1312
Remediation
Patch Available
Event History
Feb 9, 2017
Data Sourced
via Debian·09:18 PM
SeverityAffected Software
Apr 13, 2018
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
DescriptionWeakness
Jul 13, 2018
Advisory Published
via GitHub·04:01 PM
Feb 19, 2026
Data Sourced
via Debian·07:26 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-0359?
CVE-2017-0359 is rated as a medium severity vulnerability due to the potential for arbitrary file writes.
2
How do I fix CVE-2017-0359?
To fix CVE-2017-0359, upgrade diffoscope to version 77 or later.
3
What versions of diffoscope are affected by CVE-2017-0359?
CVE-2017-0359 affects diffoscope versions before 77, specifically all versions up to and including 76.
4
Can CVE-2017-0359 be exploited remotely?
CVE-2017-0359 can be exploited locally through untrusted archives, leading to arbitrary writes.
5
What platforms are impacted by CVE-2017-0359?
CVE-2017-0359 affects diffoscope installations across multiple platforms, including pip and Debian packages.