Ubuntu
ark package

  1. Xenial (16.04)
  2. Bug #1893465
  3. Comment #6

Comment 6 for bug 1893465

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ark - 4:15.12.3-0ubuntu1.2

---------------
ark (4:15.12.3-0ubuntu1.2) xenial-security; urgency=medium

  * SECURITY UPDATE: maliciously crafted TAR archive with symlinks can
    install files outside the extraction directory. (LP: #1893465)
    - 002-CVE-2020-24654-tar-symlinks-outside-extraction-directory.patch
    - CVE-2020-24654
    - Thanks to Fabian Vogt for reporting this issue and for fixing it.

 -- Eduardo Barretto <email address hidden> Tue, 01 Sep 2020 11:31:33 -0300