Description (CNA)
In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Eclipse Foundation / Eclipse Embedded CDT (C/C++ Development Tools) | unknown 0 before 6.0.0; affected 6.0.0 before 6.8.0 |
CWE
CWE-22
References
- https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/747
- https://github.com/eclipse-embed-cdt/eclipse-plugins/security/advisories/GHSA-qch4-8rmp-mjx3
ADP enrichment
No English description supplied.
No references supplied.