CVE-2018-1000801

Name	CVE-2018-1000801
Description	okular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" in "core/document.cpp" that can result in Arbitrary file creation on the user workstation. This attack appear to be exploitable via he victim must open a specially crafted Okular archive. This issue appears to have been corrected in version 18.08.1
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1516-1, DSA-4303-1
Debian Bugs	908168

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
okular (PTS)	buster	4:17.12.2-2.2+deb10u1	fixed
	bullseye	4:20.12.3-2	fixed
	bookworm	4:22.12.3-1	fixed
	sid, trixie	4:23.08.1-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
okular	source	jessie	4:4.14.2-2+deb8u1	DLA-1516-1
okular	source	stretch	4:16.08.2-1+deb9u1	DSA-4303-1
okular	source	(unstable)	4:17.12.2-2.1		908168

https://bugs.kde.org/show_bug.cgi?id=398096
https://github.com/KDE/okular/commit/8ff7abc14d41906ad978b6bc67e69693863b9d47