Input validation error in Zope - CVE-2006-3458
Published: October 3, 2018 / Updated: June 17, 2025
Vulnerability identifier: #VU111189
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2006-3458
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.
Affected software
Zope
Ubuntu
zope2.8 (Ubuntu package)
Ubuntu
zope2.8 (Ubuntu package)
How to mitigate CVE-2006-3458
Install update from vendor's website.
Zope - addressed in versions 2.7.9, 2.8.8, 2.9.4
zope2.8 (Ubuntu package) - update to 2.8.1-5ubuntu0.2
zope2.8 (Ubuntu package) - update to 2.8.1-5ubuntu0.2
External References
- http://mail.zope.org/pipermail/zope-announce/2006-July/001984.html
- http://secunia.com/advisories/20988
- http://secunia.com/advisories/21025
- http://secunia.com/advisories/21130
- http://secunia.com/advisories/21459
- http://www.debian.org/security/2006/dsa-1113
- http://www.novell.com/linux/security/advisories/2006_19_sr.html
- http://www.securityfocus.com/bid/18856
- http://www.vupen.com/english/advisories/2006/2681
- http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-20060705/README.txt
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27636
- https://usn.ubuntu.com/317-1/