CVE-2011-2725 Directory traversal vulnerability in Ark 4.7.x and earlier allows remote attackers to delete and force the display of arbitrary files via .. (dot dot) sequences in a zip file.
MediumCVSS 6.8
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in Ark 4.7.x and earlier allows remote attackers to delete and force the display of arbitrary files via .. (dot dot) sequences in a zip file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| KDE ark | <= 2.17 | No fix listed |
| kde sc | <= 4.7.4 | No fix listed |
| kde sc | = 4.7.0 | No fix listed |
| kde sc | = 4.7.1 | No fix listed |
| kde sc | = 4.7.2 | No fix listed |
| kde sc | = 4.7.3 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 10.10 | No fix listed |
| Canonical Ubuntu Linux | = 11.04 | No fix listed |
| Canonical Ubuntu Linux | = 11.10 | No fix listed |
| opensuse | = 11.4 | No fix listed |
References
- openSUSE-SU-2012:0322 vendor-advisory
- packetstormsecurity.com exploit
- 20111007 Medium severity flaw with Ark mailing-list
- USN-1276-1 vendor-advisory
- bugzilla.novell.com
- bugzilla.redhat.com exploit