CVE-2017-0359: Diffoscope - Arbitrary Write Vulnerability
Summary
CVE-2017-0359: Diffoscope may write to arbitrary locations due to an untrusted archive. Affects diffoscope versions < 76. Fixed in 76. How to fix ↓
Also tracked for
- diffoscope · Debian:11
The same CVE-2017-0359 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Diffoscope is a tool for in-depth comparison of files, archives, and directories. It is commonly used to analyze differences between binary files and identify potential vulnerabilities. This vulnerability affects Diffoscope versions prior to 76. The vulnerability allows an attacker to write to arbitrary locations on disk by exploiting the contents of an untrusted archive.
Vulnerability Detail
The vulnerability in Diffoscope arises from improper handling of untrusted archives. When processing an untrusted archive, Diffoscope fails to properly validate the file paths, allowing an attacker to write files to arbitrary locations on the disk. This can lead to unauthorized modification or deletion of critical files, potentially compromising the integrity and security of the system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 332.0.0 as of 22 Oct 2026
pip install --upgrade "diffoscope==332.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
76
This is the first release that contains the fix.
pip install --upgrade "diffoscope==76"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Diffoscope to the latest version to mitigate the risk of exploitation.
Conclusion
The arbitrary write vulnerability in Diffoscope can be mitigated by updating to version 76 or later. It is crucial to promptly apply the recommended fix to prevent potential exploitation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for diffoscope →
FAQ
Diffoscope is a tool used for in-depth comparison of files, archives, and directories. It helps identify differences between binary files and analyze potential vulnerabilities.
The vulnerability allows an attacker to write files to arbitrary locations on the disk, potentially leading to unauthorized modification or deletion of critical files.
To fix this vulnerability, it is recommended to upgrade Diffoscope to version 76 or later by running 'pip install --upgrade diffoscope'.
There is no known workaround for this vulnerability. Updating Diffoscope to the latest version is the recommended solution.
The vulnerability has a CVSS score of 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for diffoscope.
