CVE-2019-13173

fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system...

Original description

The description as published by the source.

fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2019-13173 node-fstream Fixed in: 1.0.12-1

References

patch github.com
patch npmjs.com
web lists.opensuse.org
web lists.opensuse.org
web usn.ubuntu.com