Zip Path Traversal in Deepin-Compressor
CVE-2023-50255

9.3CRITICAL

Key Information:

Vendor

linuxdeepin

Status
developer-center
Vendor
CVE Published:
27 December 2023

What is CVE-2023-50255?

Deepin Compressor, the default archive manager for Deepin Linux OS, is susceptible to a path traversal vulnerability prior to version 5.12.21. This flaw allows attackers to manipulate crafted archive files to potentially achieve remote command execution on the target system once these files are opened. Users are encouraged to upgrade to version 5.12.21 or later to mitigate this risk, as there are no known workarounds available.

Affected Version(s)

developer-center < 5.12.21

References

https://github.com/linuxdeepin/developer-center/security/...
x_refsource_CONFIRM
https://github.com/linuxdeepin/deepin-compressor/commit/8...
x_refsource_MISC

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.