CVE-2013-4668
MEDIUM severity · CVSS 5 · Path traversal
5CVSS MEDIUM
Summary
Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to fr-archive-libarchive.c and fr-window.c.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impactNone
Integrity impact—
Availability impactNone
Exploit probability (EPSS)4%
AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: https://git.gnome.org/browse/file-roller/commit/?id=b147281293a8307808475e102a14857055f81631 ↗
Additional information
- NVD record
- https://git.gnome.org/browse/file-roller/commit/?id=b147281293a8307808475e102a14857055f81631Patch
- http://archives.neohapsis.com/archives/bugtraq/2013-07/0039.html
- http://lists.opensuse.org/opensuse-updates/2013-07/msg00095.html
- http://secunia.com/advisories/54351Advisory
- http://www.ocert.org/advisories/ocert-2013-001.htmlAdvisory
- http://www.securityfocus.com/bid/61008Advisory
- http://www.ubuntu.com/usn/USN-1906-1Advisory