autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-36241.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "libgnome-autoar-gtk-0-dev": "0.2.3-1ubuntu0.3", "libgnome-autoar-0-dev": "0.2.3-1ubuntu0.3", "gir1.2-gnomeautoargtk-0.1": "0.2.3-1ubuntu0.3", "libgnome-autoar-gtk-0-0": "0.2.3-1ubuntu0.3", "libgnome-autoar-doc": "0.2.3-1ubuntu0.3", "libgnome-autoar-gtk-0-0-dbgsym": "0.2.3-1ubuntu0.3", "libgnome-autoar-0-0-dbgsym": "0.2.3-1ubuntu0.3", "libgnome-autoar-0-0": "0.2.3-1ubuntu0.3", "gir1.2-gnomeautoar-0.1": "0.2.3-1ubuntu0.3" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "libgnome-autoar-gtk-0-dev": "0.2.3-2ubuntu0.3", "libgnome-autoar-0-dev": "0.2.3-2ubuntu0.3", "gir1.2-gnomeautoargtk-0.1": "0.2.3-2ubuntu0.3", "libgnome-autoar-gtk-0-0": "0.2.3-2ubuntu0.3", "libgnome-autoar-doc": "0.2.3-2ubuntu0.3", "libgnome-autoar-gtk-0-0-dbgsym": "0.2.3-2ubuntu0.3", "libgnome-autoar-0-0-dbgsym": "0.2.3-2ubuntu0.3", "libgnome-autoar-0-0": "0.2.3-2ubuntu0.3", "gir1.2-gnomeautoar-0.1": "0.2.3-2ubuntu0.3" } ] }