autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "libgnome-autoar-gtk-0-dev": "0.2.3-1ubuntu0.1", "libgnome-autoar-0-dev": "0.2.3-1ubuntu0.1", "gir1.2-gnomeautoargtk-0.1": "0.2.3-1ubuntu0.1", "libgnome-autoar-gtk-0-0": "0.2.3-1ubuntu0.1", "libgnome-autoar-doc": "0.2.3-1ubuntu0.1", "libgnome-autoar-gtk-0-0-dbgsym": "0.2.3-1ubuntu0.1", "libgnome-autoar-0-0-dbgsym": "0.2.3-1ubuntu0.1", "libgnome-autoar-0-0": "0.2.3-1ubuntu0.1", "gir1.2-gnomeautoar-0.1": "0.2.3-1ubuntu0.1" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "libgnome-autoar-gtk-0-dev": "0.2.3-2ubuntu0.1", "libgnome-autoar-0-dev": "0.2.3-2ubuntu0.1", "gir1.2-gnomeautoargtk-0.1": "0.2.3-2ubuntu0.1", "libgnome-autoar-gtk-0-0": "0.2.3-2ubuntu0.1", "libgnome-autoar-doc": "0.2.3-2ubuntu0.1", "libgnome-autoar-gtk-0-0-dbgsym": "0.2.3-2ubuntu0.1", "libgnome-autoar-0-0-dbgsym": "0.2.3-2ubuntu0.1", "libgnome-autoar-0-0": "0.2.3-2ubuntu0.1", "gir1.2-gnomeautoar-0.1": "0.2.3-2ubuntu0.1" } ] }