CVE-2013-4668 Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafte...
MediumCVSS 5.0
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to fr-archive-libarchive.c and fr-window.c.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/file-roller(Debian:12) | < 3.8.3-1 | 3.8.3-1 |
| debian/file-roller(Debian:13) | < 3.8.3-1 | 3.8.3-1 |
| debian/file-roller(Debian:14) | < 3.8.3-1 | 3.8.3-1 |
| file roller project file roller | >= 3.6.0, < 3.6.4 | 3.6.4 |
| file roller project file roller | >= 3.8.0, < 3.8.3 | 3.8.3 |
| file roller project file roller | >= 3.9.1, < 3.9.3 | 3.9.3 |
| Canonical Ubuntu Linux | = 12.10 | No fix listed |
| Canonical Ubuntu Linux | = 13.04 | No fix listed |
References
- Debian Security Tracker CVE-2013-4668 vendor-advisory
- 20130708 [oCERT-2013-001] File Roller path sanitization errors broken-link mailing-list
- openSUSE-SU-2013:1281 broken-link vendor-advisory
- 54351 not-applicable third-party-advisory
- www.ocert.org third-party-advisory
- 61008 third-party-advisory vdb-entry
- USN-1906-1 third-party-advisory vendor-advisory
- git.gnome.org patch third-party-advisory