PT-2013-5119 · Gnome · File Roller

Yorick Koster · Publicado 2013-07-18 · Atualizado 2021-04-28 · CVE-2013-4668

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions File Roller versions 3.6.x through 3.6.3 File Roller versions 3.8.x through 3.8.2 File Roller versions 3.9.x through 3.9.2

Description The issue allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to fr-archive-libarchive.c and fr-window.c, when libarchive is used.

Recommendations For versions 3.6.x through 3.6.3, update to version 3.6.4 or later. For versions 3.8.x through 3.8.2, update to version 3.8.3 or later. For versions 3.9.x through 3.9.2, update to version 3.9.3 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2013-4668

MGASA-2013-0232

Produtos afetados

File Roller

Referências · 17

• https://security-tracker.debian.org/tracker/CVE-2013-4668 · Aviso do Fabricante
• http://ubuntu.com/usn/USN-1906-1 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2013-0232.html · Nota de Segurança
• https://lists.fedoraproject.org/pipermail/package-announce/2013-July/111666.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4668 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2013-07/msg00095.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-4668 · Nota de Segurança
• https://git.gnome.org/browse/file-roller/commit/?id=b147281293a8307808475e102a14857055f81631 · Correção
• http://ocert.org/advisories/ocert-2013-001.html · Nota
• https://osv.dev/vulnerability/CVE-2013-4668 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=10782 · Nota
• http://secunia.com/advisories/54351 · Nota
• http://securityfocus.com/bid/61008 · Nota
• https://t.me/cvenotify/13729 · Publicação no Telegram
• http://archives.neohapsis.com/archives/bugtraq/2013-07/0039.html · Nota