Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2021:0390-1

Опубликовано: 06 мар. 2021
Источник: suse-cvrf

Описание

Security update for gnome-autoar

This update for gnome-autoar fixes the following issues:

  • CVE-2020-36241: Skip problematic files that might be extracted outside of the destination dir to prevent potential directory traversal (bsc#1181930).

This update was imported from the SUSE:SLE-15:Update update project.

Список пакетов

openSUSE Leap 15.2
gnome-autoar-devel-0.2.3-lp152.4.3.1
libgnome-autoar-0-0-0.2.3-lp152.4.3.1
libgnome-autoar-gtk-0-0-0.2.3-lp152.4.3.1
typelib-1_0-GnomeAutoar-0_1-0.2.3-lp152.4.3.1
typelib-1_0-GnomeAutoarGtk-0_1-0.2.3-lp152.4.3.1

Ссылки

Описание

autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.

Затронутые продукты
openSUSE Leap 15.2:gnome-autoar-devel-0.2.3-lp152.4.3.1
openSUSE Leap 15.2:libgnome-autoar-0-0-0.2.3-lp152.4.3.1
openSUSE Leap 15.2:libgnome-autoar-gtk-0-0-0.2.3-lp152.4.3.1
openSUSE Leap 15.2:typelib-1_0-GnomeAutoar-0_1-0.2.3-lp152.4.3.1
Ссылки