Summary
Yiğit Can Yılmaz discovered that GNOME Autoar could extract files outside
of the intended directory. If a user were tricked into extracting a
specially crafted archive, a remote attacker could create files in
arbitrary locations, possibly leading to code execution.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | gnome-autoar | 0.2.3-1ubuntu0.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | gnome-autoar | 0.2.3-2ubuntu0.1 |
Vulnerabilities 1
-
Unscored —
autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Di…
References
-
report
https://ubuntu.com/security/CVE-2020-36241