CVE-2020-36241
Summary
| CVE | CVE-2020-36241 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-02-05 14:15:00 UTC |
| Updated | 2023-11-07 03:22:00 UTC |
| Description | autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location. |
Risk And Classification
Problem Types: CWE-22 | CWE-59
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Fedoraproject | Fedora | 34 | All | All | All |
| Application | Gnome | Gnome-autoar | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| GNOME Autoar: User-assisted execution of arbitrary code (GLSA 202105-10) — Gentoo security | GENTOO | security.gentoo.org | |
| CVE-2020-36241: A malicious archive allows Directory Traversal during extraction (#7) · Issues · GNOME / gnome-autoar · GitLab | MISC | gitlab.gnome.org | Exploit, Issue Tracking, Vendor Advisory |
| [SECURITY] Fedora 34 Update: glib2-2.67.6-2.fc34 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| AutoarExtractor: Do not extract files outside the destination dir (adb067e6) · Commits · GNOME / gnome-autoar · GitLab | MISC | gitlab.gnome.org | Patch, Vendor Advisory |
| [SECURITY] Fedora 34 Update: glib2-2.67.6-2.fc34 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159499 Oracle Enterprise Linux Security Update for GNOME (ELSA-2021-4381)
- 239811 Red Hat Update for gnome security (RHSA-2021:4381)
- 281465 Fedora Security Update for adwaita (FEDORA-2021-303f6623fa)
- 296067 Oracle Solaris 11.4 Support Repository Update (SRU) 33.94.0 Missing (CPUAPR2021)
- 501564 Alpine Linux Security Update for gnome-autoar
- 710105 Gentoo Linux GNOME Autoar User-assisted execution of arbitrary code vulnerability (GLSA 202105-10)
- 750327 OpenSUSE Security Update for gnome-autoar (openSUSE-SU-2021:0390-1)
- 940070 AlmaLinux Security Update for GNOME (ALSA-2021:4381)