Summary
Dominik Penner discovered that Ark did not properly sanitize zip archive
files before performing extraction. An attacker could use this to construct
a malicious zip archive that, when opened, would create files outside the
extraction directory.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | ark | 4:17.12.3-0ubuntu1.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | ark | 4:19.12.3-0ubuntu1.1 |
Vulnerabilities 1
-
Unscored —
In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory v…
References
-
report
https://ubuntu.com/security/CVE-2020-16116