RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_name": "libunrar-dev", "binary_version": "1:5.6.6-2ubuntu0.1" }, { "binary_name": "libunrar5", "binary_version": "1:5.6.6-2ubuntu0.1" }, { "binary_name": "unrar", "binary_version": "1:5.6.6-2ubuntu0.1" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_name": "libclamunrar", "binary_version": "0.103.11-0ubuntu0.22.04.1" }, { "binary_name": "libclamunrar9", "binary_version": "0.103.11-0ubuntu0.22.04.1" }, { "binary_name": "libclamunrar9-dbgsym", "binary_version": "0.103.11-0ubuntu0.22.04.1" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_name": "libunrar-dev", "binary_version": "1:6.1.5-1ubuntu0.1" }, { "binary_name": "libunrar-headers", "binary_version": "1:6.1.5-1ubuntu0.1" }, { "binary_name": "libunrar5", "binary_version": "1:6.1.5-1ubuntu0.1" }, { "binary_name": "libunrar5-dbgsym", "binary_version": "1:6.1.5-1ubuntu0.1" }, { "binary_name": "unrar", "binary_version": "1:6.1.5-1ubuntu0.1" }, { "binary_name": "unrar-dbgsym", "binary_version": "1:6.1.5-1ubuntu0.1" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_name": "clamav-testfiles-rar", "binary_version": "1.0.3-1" }, { "binary_name": "libclamunrar", "binary_version": "1.0.3-1" }, { "binary_name": "libclamunrar11", "binary_version": "1.0.3-1" }, { "binary_name": "libclamunrar11-dbgsym", "binary_version": "1.0.3-1" } ] }