Summary
Fabian Vogt discovered that Ark incorrectly handled symbolic links in
tar archive files. An attacker could use this to construct a malicious
tar archive that, when opened, would create files outside the extraction
directory.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | ark | 4:15.12.3-0ubuntu1.2 |
| Ubuntu · 18.04 LTS 18.04:LTS | ark | 4:17.12.3-0ubuntu1.2 |
| Ubuntu · 20.04 LTS 20.04:LTS | ark | 4:19.12.3-0ubuntu1.2 |
Vulnerabilities 1
-
Unscored —
In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as d…
References
-
report
https://ubuntu.com/security/CVE-2020-24654