Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2021:0687-1

Опубликовано: 02 мар. 2021
Источник: suse-cvrf

Описание

Security update for gnome-autoar

This update for gnome-autoar fixes the following issues:

  • CVE-2020-36241: Skip problematic files that might be extracted outside of the destination dir to prevent potential directory traversal (bsc#1181930).

Список пакетов

SUSE Linux Enterprise Module for Desktop Applications 15 SP2
gnome-autoar-devel-0.2.3-3.3.1
libgnome-autoar-0-0-0.2.3-3.3.1
libgnome-autoar-gtk-0-0-0.2.3-3.3.1
typelib-1_0-GnomeAutoar-0_1-0.2.3-3.3.1
typelib-1_0-GnomeAutoarGtk-0_1-0.2.3-3.3.1

Ссылки

Описание

autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.

Затронутые продукты
SUSE Linux Enterprise Module for Desktop Applications 15 SP2:gnome-autoar-devel-0.2.3-3.3.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP2:libgnome-autoar-0-0-0.2.3-3.3.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP2:libgnome-autoar-gtk-0-0-0.2.3-3.3.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP2:typelib-1_0-GnomeAutoar-0_1-0.2.3-3.3.1
Ссылки