ISOMAN

CVE

CVE-2019-16680

An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.

Severity
MEDIUM
CVSS
4.3
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu18.04.6 amd64 desktopunknownsource
Ubuntu18.04.6 amd64 live-serverunknownsource
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource

References

  1. https://bugzilla.gnome.org/show_bug.cgi?id=794337
  2. https://gitlab.gnome.org/GNOME/file-roller/commit/57268e51e59b61c9e3125eb0f65551c7084297e2
  3. https://gitlab.gnome.org/GNOME/file-roller/commit/e8fb3e24dae711e4fb0d6777e0016cdda8787bc1
  4. https://lists.debian.org/debian-lts-announce/2019/09/msg00032.html
  5. https://seclists.org/bugtraq/2019/Sep/57
  6. https://usn.ubuntu.com/4139-1/
  7. https://www.debian.org/security/2019/dsa-4537
  8. https://bugzilla.redhat.com/show_bug.cgi?id=1767594
  9. https://bugzilla.gnome.org/show_bug.cgi?id=794337
  10. https://gitlab.gnome.org/GNOME/file-roller/commit/57268e51e59b61c9e3125eb0f65551c7084297e2
  11. https://gitlab.gnome.org/GNOME/file-roller/commit/e8fb3e24dae711e4fb0d6777e0016cdda8787bc1
  12. https://lists.debian.org/debian-lts-announce/2019/09/msg00032.html
  13. https://seclists.org/bugtraq/2019/Sep/57
  14. https://usn.ubuntu.com/4139-1/
  15. https://www.debian.org/security/2019/dsa-4537