UBUNTU-CVE-2019-16680

An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.

References

Affected packages

Ubuntu:16.04:LTS / file-roller

Package

Name: file-roller
Purl: pkg:deb/ubuntu/file-roller@3.16.5-0ubuntu1.3?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.16.5-0ubuntu1.3

Affected versions

3.*

3.16.4-1ubuntu3

3.16.5-0ubuntu1

3.16.5-0ubuntu1.1

3.16.5-0ubuntu1.2

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.16.5-0ubuntu1.3",
            "binary_name": "file-roller"
        }
    ],
    "availability": "No subscription required"
}

Ubuntu:18.04:LTS / file-roller

Package

Name: file-roller
Purl: pkg:deb/ubuntu/file-roller@3.28.0-1ubuntu1.1?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.28.0-1ubuntu1.1

Affected versions

3.*

3.26.1-0ubuntu1

3.26.2-0ubuntu1

3.26.2-3ubuntu1

3.28.0-1ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.28.0-1ubuntu1.1",
            "binary_name": "file-roller"
        }
    ],
    "availability": "No subscription required"
}