Summary
Ondrej Holy discovered that GNOME Autoar could extract files outside of the
intended directory. If a user were tricked into extracting a specially
crafted archive, a remote attacker could create files in arbitrary
locations, possibly leading to code execution.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | gnome-autoar | 0.2.3-1ubuntu0.3 |
| Ubuntu · 20.04 LTS 20.04:LTS | gnome-autoar | 0.2.3-2ubuntu0.3 |
Vulnerabilities 1
-
Unscored —
autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Dir…
References
-
report
https://ubuntu.com/security/CVE-2021-28650