| Name | CVE-2019-16680 |
| Description | An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-1938-1, DSA-4537-1 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| file-roller (PTS) | buster | 3.30.1-2+deb10u1 | fixed |
| bullseye | 3.38.1-1 | fixed |
| bookworm | 43.0-1 | fixed |
| trixie | 43.1-1 | fixed |
| sid | 44.1-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
https://bugzilla.gnome.org/show_bug.cgi?id=794337
https://gitlab.gnome.org/GNOME/file-roller/commit/57268e51e59b61c9e3125eb0f65551c7084297e2