[ASA-202009-2] ark: arbitrary filesystem access
foxboron at archlinux.org
Wed Sep 9 21:47:08 UTC 2020
Arch Linux Security Advisory ASA-202009-2
Date : 2020-09-03
CVE-ID : CVE-2020-24654
Package : ark
Type : arbitrary filesystem access
Remote : No
Link : https://security.archlinux.org/AVG-1216
The package ark before version 20.08.0-2 is vulnerable to arbitrary
Upgrade to 20.08.0-2.
# pacman -Syu "ark>=20.08.0-2"
The problem has been fixed upstream but no release is available yet.
In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can
install files outside the extraction directory, as demonstrated by a
write operation to a user's home directory.
An attacker can overwrite local files by tricking a legitimate user
into extracting a specially crafted TAR archive.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security