CVE-2019-16680

An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.

Score

CVSS 3.1 4.3 Medium

Status

Modified - cve@mitre.org

Published

2019-09-21

Last modified

2024-08-05

Weaknesses

CWE-22

Affected products

• Ubuntu Linux (Canonical)
• Debian Linux (Debian)
• File-roller (Gnome)
• Enterprise Linux (Redhat)

References

• https://bugzilla.gnome.org/show_bug.cgi?id=794337
• https://gitlab.gnome.org/GNOME/file-roller/commit/57268e51e59b61c9e3125eb0f65551c7084297e2
• https://gitlab.gnome.org/GNOME/file-roller/commit/e8fb3e24dae711e4fb0d6777e0016cdda8787bc1
• https://lists.debian.org/debian-lts-announce/2019/09/msg00032.html
• https://seclists.org/bugtraq/2019/Sep/57
• https://usn.ubuntu.com/4139-1/
• https://www.debian.org/security/2019/dsa-4537
• https://bugzilla.redhat.com/show_bug.cgi?id=1767594