CVE-2020-36241

5.5MEDIUM

Key Information:

Vendor
Gnome
Status
Gnome-autoar
Vendor
CVE Published:
5 February 2021

Summary

autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.

References

https://gitlab.gnome.org/GNOME/gnome-autoar/-/issues/7
x_refsource_MISC
https://gitlab.gnome.org/GNOME/gnome-autoar/-/commit/adb0...
x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisoryx_refsource_FEDORA

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.