fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.
CVSS Details
- CVSS 3.1 Base Score: 3.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade file-roller | May 4, 2022 | Apr 13, 2020 |
| Centos_linux | — | Upgrade file-rollerUpgrade file-roller-debuginfoUpgrade file-roller-debugsource | Nov 5, 2020 | Apr 13, 2020 |
| Debian | — | Upgrade file-roller | Apr 20, 2020 | Apr 13, 2020 |
| Gentoo Linux | — | Upgrade app-arch/file-roller. | Sep 14, 2020 | Apr 13, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade file-roller-nautilusUpgrade file-roller | Feb 22, 2021 | Apr 13, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade file-roller-nautilusUpgrade file-roller | Apr 30, 2021 | Apr 13, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade file-roller-nautilusUpgrade file-roller | Nov 2, 2020 | Apr 13, 2020 |
| Oracle Solaris | — | Upgrade desktop/archive-manager/file-roller to version 3.24.0-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Apr 13, 2020 |
| Oracle_linux | — | Upgrade file-roller | Nov 14, 2020 | Apr 12, 2020 |
| Redhat_linux | — | Upgrade file-rollerUpgrade file-roller-debugsourceUpgrade file-roller-debuginfoNo solution exists | Nov 5, 2020 | Apr 13, 2020 |
| Rocky_linux | — | Upgrade file-roller-debugsourceUpgrade file-roller-debuginfoUpgrade file-roller | Mar 12, 2024 | Apr 13, 2020 |
| Suse | — | Upgrade nautilus-file-rollerUpgrade file-roller-langUpgrade file-roller | May 30, 2020 | Apr 13, 2020 |
| Ubuntu | — | Upgrade file-roller | Apr 21, 2020 | Apr 13, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub