Path traversal in file-roller - CVE-2019-16680

Vulnerability identifier: #VU21275

CSH Severity: Low

CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-16680

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to the affected software allows a single path traversal sequence to be present in the TAR file name. A remote attacker can send a specially crafted archive and overwrite arbitrary files located one directory above the current file location.

file-roller
file-roller (Ubuntu package)
file-roller (Debian package)
file-roller (Red Hat package)
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Opensuse

Install updates from vendor's website.

file-roller - update to 3.9.91
file-roller (Ubuntu package) - addressed in versions 3.16.5-0ubuntu1.3, 3.28.0-1ubuntu1.1
file-roller (Debian package) - update to 3.22.3-1+deb9u1
file-roller (Red Hat package) - update to 3.28.1-3.el8

• https://bugzilla.gnome.org/show_bug.cgi?id=794337
• https://gitlab.gnome.org/GNOME/file-roller/commit/57268e51e59b61c9e3125eb0f65551c7084297e2
• https://gitlab.gnome.org/GNOME/file-roller/commit/e8fb3e24dae711e4fb0d6777e0016cdda8787bc1

• Path traversal in GNOME file-roller
• Ubuntu update for File Roller
• Debian update for file-roller
• OpenSUSE Linux update for file-roller
• Red Hat Enterprise Linux 8 update for file-roller