Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2020-36314

file-roller: directory traversal via directory symlink pointing outside of the target directory (incomplete fix for CVE-2020-11736)

fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Gnome Redhat
Products
Fedora File-roller Enterprise Linux
CVE-2020-11736

file-roller: directory traversal via directory symlink pointing outside of the target directory

fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Gnome and 1 more
Products
Ubuntu Linux Debian Linux File-roller and 1 more
CVE-2019-16680

file-roller: path traversal vulnerability via a specially crafted filename contained in malicious archive

An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.

CVSS 3.1 · 4.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Gnome and 1 more
Products
Ubuntu Linux Debian Linux File-roller and 1 more