Secunia

Claus Berghammer has discovered a vulnerability in QuickZip, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an input validation error when extracting files compressed with TAR (.tar) or GZ (.gz). This makes it possible to have files extracted to arbitrary locations outside the specified directory using the "../" directory traversal sequence.

NOTE: The JAR (.jar) file format is also affected. However, only directories can be extracted outside of the specified directory.

The vulnerability has been confirmed in version 3.06.3. Other versions may also be affected.

Solution
Do not extract untrusted archives.
Further details available in Customer Area

Provided and/or discovered by
Claus Berghammer

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area