[Bug 1893465] Re: KDE Project Security Advisory: Ark: maliciously crafted TAR archive with symlinks can install files outside the extraction directory.

Launchpad Bug Tracker 1893465 at bugs.launchpad.net
Tue Sep 1 19:43:25 UTC 2020


This bug was fixed in the package ark - 4:19.12.3-0ubuntu1.2

---------------
ark (4:19.12.3-0ubuntu1.2) focal-security; urgency=medium

  * SECURITY UPDATE: maliciously crafted TAR archive with symlinks can
    install files outside the extraction directory. (LP: #1893465)
    - 002-CVE-2020-24654-tar-symlinks-outside-extraction-directory.patch
    - CVE-2020-24654
    - Thanks to Fabian Vogt for reporting this issue and for fixing it.

 -- vishnunaini <vishnu at vishnunaini.com>  Fri, 28 Aug 2020 22:12:54
+0530

-- 
You received this bug notification because you are a member of Kubuntu
Bugs, which is subscribed to ark in Ubuntu.
https://bugs.launchpad.net/bugs/1893465

Title:
  KDE Project Security Advisory: Ark: maliciously crafted TAR archive
  with symlinks can install files outside the extraction directory.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ark/+bug/1893465/+subscriptions



More information about the kubuntu-bugs mailing list