Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2021-28650 →

DEBIAN-CVE-2021-28650

autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extract...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-36241.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 gnome-autoar

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-1"}]}]

Debian:13 gnome-autoar

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-1"}]}]

Debian:14 gnome-autoar

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-1"}]}]

Références

advisory security-tracker.debian.org