The Sleuth Kit vulnerabilities
3 known vulnerabilities in The Sleuth Kit from Sleuthkit. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.1 High severity
sleuthkit: Out-of-bounds Read
The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parse_susp() function trusts len_id, len_des, and len_src fields from the disk image to memcpy data into a stack buffer without verifying that
- 7.1 High severity
sleuthkit: Improper Limitation of a Pathname to a Restricted Directory
The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in
- 7.8 High severity
The Sleuth Kit: Improper Neutralization of Special Elements used in an OS Command
OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the backtick command execute