In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.
CVSS Details
- CVSS 3.1 Base Score: 3.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ark | Oct 22, 2020 | Aug 3, 2020 |
| Debian | — | Upgrade ark | Aug 4, 2020 | Aug 4, 2020 |
| Freebsd | — | Upgrade ark | Jul 31, 2020 | Jul 30, 2020 |
| Gentoo Linux | — | Upgrade kde-apps/ark. | Aug 10, 2020 | Aug 3, 2020 |
| Suse | — | Upgrade libkerfuffle20Upgrade arkUpgrade ark-langUpgrade libkerfuffle18 | Aug 13, 2020 | Jul 30, 2020 |
| Ubuntu | — | Upgrade ark | Aug 19, 2020 | Jul 30, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub