autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-36241.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "0.2.3-1ubuntu0.3", "binary_name": "gir1.2-gnomeautoar-0.1" }, { "binary_version": "0.2.3-1ubuntu0.3", "binary_name": "gir1.2-gnomeautoargtk-0.1" }, { "binary_version": "0.2.3-1ubuntu0.3", "binary_name": "libgnome-autoar-0-0" }, { "binary_version": "0.2.3-1ubuntu0.3", "binary_name": "libgnome-autoar-0-0-dbgsym" }, { "binary_version": "0.2.3-1ubuntu0.3", "binary_name": "libgnome-autoar-0-dev" }, { "binary_version": "0.2.3-1ubuntu0.3", "binary_name": "libgnome-autoar-doc" }, { "binary_version": "0.2.3-1ubuntu0.3", "binary_name": "libgnome-autoar-gtk-0-0" }, { "binary_version": "0.2.3-1ubuntu0.3", "binary_name": "libgnome-autoar-gtk-0-0-dbgsym" }, { "binary_version": "0.2.3-1ubuntu0.3", "binary_name": "libgnome-autoar-gtk-0-dev" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "0.2.3-2ubuntu0.3", "binary_name": "gir1.2-gnomeautoar-0.1" }, { "binary_version": "0.2.3-2ubuntu0.3", "binary_name": "gir1.2-gnomeautoargtk-0.1" }, { "binary_version": "0.2.3-2ubuntu0.3", "binary_name": "libgnome-autoar-0-0" }, { "binary_version": "0.2.3-2ubuntu0.3", "binary_name": "libgnome-autoar-0-0-dbgsym" }, { "binary_version": "0.2.3-2ubuntu0.3", "binary_name": "libgnome-autoar-0-dev" }, { "binary_version": "0.2.3-2ubuntu0.3", "binary_name": "libgnome-autoar-doc" }, { "binary_version": "0.2.3-2ubuntu0.3", "binary_name": "libgnome-autoar-gtk-0-0" }, { "binary_version": "0.2.3-2ubuntu0.3", "binary_name": "libgnome-autoar-gtk-0-0-dbgsym" }, { "binary_version": "0.2.3-2ubuntu0.3", "binary_name": "libgnome-autoar-gtk-0-dev" } ] }