Published: 02/09/2020 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 3.3 | Impact Score: 1.4 | Exploitability Score: 1.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

In KDE Ark prior to 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.

Vulnerable Product	Search on Vulmon	Subscribe to Product
kde ark
canonical ubuntu linux 16.04
debian debian linux 10.0
canonical ubuntu linux 18.04
opensuse leap 15.1
fedoraproject fedora 32
canonical ubuntu linux 20.04
opensuse leap 15.2
debian debian linux 9.0
fedoraproject fedora 33

Debian Bug report logs - #969437 ark: CVE-2020-24654 Package: src:ark; Maintainer for src:ark is Debian/Kubuntu Qt/KDE Maintainers <debian-qt-kde@listsdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 2 Sep 2020 20:45:06 UTC Severity: important Tags: security, upstream Found in version ...

Fabian Vogt reported that the Ark archive manager did not sanitise extraction paths, which could result in maliciously crafted archives with symlinks writing outside the extraction directory For the stable distribution (buster), this problem has been fixed in version 4:18083-1+deb10u2 We recommend that you upgrade your ark packages For the det ...

In KDE Ark before 20081, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory ...

CWE-59 http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00001.html https://kde.org/info/security/advisory-20200827-1.txt https://bugzilla.suse.com/show_bug.cgi?id=1175857 https://github.com/KDE/ark/commit/8bf8c5ef07b0ac5e914d752681e470dea403a5bd https://www.debian.org/security/2020/dsa-4759 https://usn.ubuntu.com/4482-1/https://security.gentoo.org/glsa/202010-06 https://security.gentoo.org/glsa/202101-06 https://lists.debian.org/debian-lts-announce/2022/05/msg00026.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LXMMXNJDYOCJRZTESIUGHG6CS4RJKECX/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJOZ6YRNPZX5MJGVBMOCOA7N6Z4EU2OK/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=969437 https://nvd.nist.gov https://www.debian.org/security/2020/dsa-4759

CVE-2020-24654

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect