CVE-2020-36241 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2020-36241 Interim 1 29 2023-06-12T23:57:06Z current 2021-05-30T14:46:09Z 2023-06-12T23:57:06Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2020-36241 autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2021-March/008403.html E-Mail link for SUSE-SU-2021:0664-1 https://lists.suse.com/pipermail/sle-security-updates/2021-March/008420.html E-Mail link for SUSE-SU-2021:0687-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CYPCMBEG7F5HYZ6RXTSOZ7RTGRUXLCS2/ E-Mail link for openSUSE-SU-2021:0390-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Desktop Applications 15 SP2 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 SUSE Linux Enterprise Module for Desktop Applications 15 SP2 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 SUSE Linux Enterprise Module for Desktop Applications 15 SP4 SUSE Linux Enterprise Module for Desktop Applications 15 SP5 SUSE Linux Enterprise Module for Desktop Applications 15 SP2 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 SUSE Linux Enterprise Module for Desktop Applications 15 SP4 SUSE Linux Enterprise Module for Desktop Applications 15 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 SUSE Linux Enterprise Module for Desktop Applications 15 SP2 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 SUSE Linux Enterprise Module for Desktop Applications 15 SP4 SUSE Linux Enterprise Module for Desktop Applications 15 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 SUSE Linux Enterprise Module for Desktop Applications 15 SP2 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 SUSE Linux Enterprise Module for Desktop Applications 15 SP4 SUSE Linux Enterprise Module for Desktop Applications 15 SP5 SUSE Linux Enterprise Module for Desktop Applications 15 SP2 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 SUSE Linux Enterprise Module for Desktop Applications 15 SP4 SUSE Linux Enterprise Module for Desktop Applications 15 SP2 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 SUSE Linux Enterprise Module for Desktop Applications 15 SP4 SUSE Linux Enterprise Module for Desktop Applications 15 SP2 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 SUSE Linux Enterprise Module for Desktop Applications 15 SP4 openSUSE Leap 15.2 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Tumbleweed gnome-autoar-devel-0.2.3-3.3.1 gnome-autoar-devel-0.2.3-lp152.4.3.1 gnome-autoar-devel-0.4.0-1.3 gnome-autoar-devel-0.4.1-150400.1.10 libgnome-autoar-0-0-0.2.2-3.5.1 libgnome-autoar-0-0-0.2.3-3.3.1 libgnome-autoar-0-0-0.2.3-lp152.4.3.1 libgnome-autoar-0-0-0.4.0-1.3 libgnome-autoar-0-0-0.4.1-150400.1.10 libgnome-autoar-gtk-0-0-0.2.2-3.5.1 libgnome-autoar-gtk-0-0-0.2.3-3.3.1 libgnome-autoar-gtk-0-0-0.2.3-lp152.4.3.1 libgnome-autoar-gtk-0-0-0.4.0-1.3 libgnome-autoar-gtk-0-0-0.4.1-150400.1.10 typelib-1_0-GnomeAutoar-0_1-0.2.3-3.3.1 typelib-1_0-GnomeAutoar-0_1-0.2.3-lp152.4.3.1 typelib-1_0-GnomeAutoar-0_1-0.4.0-1.3 typelib-1_0-GnomeAutoar-0_1-0.4.1-150400.1.10 typelib-1_0-GnomeAutoarGtk-0_1-0.2.3-3.3.1 typelib-1_0-GnomeAutoarGtk-0_1-0.2.3-lp152.4.3.1 typelib-1_0-GnomeAutoarGtk-0_1-0.4.0-1.3 typelib-1_0-GnomeAutoarGtk-0_1-0.4.1-150400.1.10 gnome-autoar-devel-0.2.3-3.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP2 libgnome-autoar-0-0-0.2.3-3.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP2 libgnome-autoar-gtk-0-0-0.2.3-3.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP2 typelib-1_0-GnomeAutoar-0_1-0.2.3-3.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP2 typelib-1_0-GnomeAutoarGtk-0_1-0.2.3-3.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP2 gnome-autoar-devel-0.2.3-3.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 libgnome-autoar-0-0-0.2.3-3.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 libgnome-autoar-gtk-0-0-0.2.3-3.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 typelib-1_0-GnomeAutoar-0_1-0.2.3-3.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 typelib-1_0-GnomeAutoarGtk-0_1-0.2.3-3.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 gnome-autoar-devel-0.4.1-150400.1.10 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4 libgnome-autoar-0-0-0.4.1-150400.1.10 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4 libgnome-autoar-gtk-0-0-0.4.1-150400.1.10 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4 typelib-1_0-GnomeAutoar-0_1-0.4.1-150400.1.10 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4 typelib-1_0-GnomeAutoarGtk-0_1-0.4.1-150400.1.10 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4 gnome-autoar-devel-0.4.1-150400.1.10 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP5 libgnome-autoar-0-0-0.4.1-150400.1.10 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP5 libgnome-autoar-gtk-0-0-0.4.1-150400.1.10 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP5 typelib-1_0-GnomeAutoar-0_1-0.4.1-150400.1.10 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP5 typelib-1_0-GnomeAutoarGtk-0_1-0.4.1-150400.1.10 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP5 libgnome-autoar-0-0-0.2.2-3.5.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libgnome-autoar-gtk-0-0-0.2.2-3.5.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 gnome-autoar-devel-0.2.3-lp152.4.3.1 as a component of openSUSE Leap 15.2 libgnome-autoar-0-0-0.2.3-lp152.4.3.1 as a component of openSUSE Leap 15.2 libgnome-autoar-gtk-0-0-0.2.3-lp152.4.3.1 as a component of openSUSE Leap 15.2 typelib-1_0-GnomeAutoar-0_1-0.2.3-lp152.4.3.1 as a component of openSUSE Leap 15.2 typelib-1_0-GnomeAutoarGtk-0_1-0.2.3-lp152.4.3.1 as a component of openSUSE Leap 15.2 libgnome-autoar-0-0-0.2.3-3.3.1 as a component of openSUSE Leap 15.3 libgnome-autoar-gtk-0-0-0.2.3-3.3.1 as a component of openSUSE Leap 15.3 libgnome-autoar-0-0-0.4.1-150400.1.10 as a component of openSUSE Leap 15.4 libgnome-autoar-gtk-0-0-0.4.1-150400.1.10 as a component of openSUSE Leap 15.4 gnome-autoar-devel-0.4.0-1.3 as a component of openSUSE Tumbleweed libgnome-autoar-0-0-0.4.0-1.3 as a component of openSUSE Tumbleweed libgnome-autoar-gtk-0-0-0.4.0-1.3 as a component of openSUSE Tumbleweed typelib-1_0-GnomeAutoar-0_1-0.4.0-1.3 as a component of openSUSE Tumbleweed typelib-1_0-GnomeAutoarGtk-0_1-0.4.0-1.3 as a component of openSUSE Tumbleweed autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location. CVE-2020-36241 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:gnome-autoar-devel-0.2.3-3.3.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:libgnome-autoar-0-0-0.2.3-3.3.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:libgnome-autoar-gtk-0-0-0.2.3-3.3.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:typelib-1_0-GnomeAutoar-0_1-0.2.3-3.3.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:typelib-1_0-GnomeAutoarGtk-0_1-0.2.3-3.3.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:gnome-autoar-devel-0.2.3-3.3.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:libgnome-autoar-0-0-0.2.3-3.3.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:libgnome-autoar-gtk-0-0-0.2.3-3.3.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:typelib-1_0-GnomeAutoar-0_1-0.2.3-3.3.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:typelib-1_0-GnomeAutoarGtk-0_1-0.2.3-3.3.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP4:gnome-autoar-devel-0.4.1-150400.1.10 SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libgnome-autoar-0-0-0.4.1-150400.1.10 SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libgnome-autoar-gtk-0-0-0.4.1-150400.1.10 SUSE Linux Enterprise Module for Desktop Applications 15 SP4:typelib-1_0-GnomeAutoar-0_1-0.4.1-150400.1.10 SUSE Linux Enterprise Module for Desktop Applications 15 SP4:typelib-1_0-GnomeAutoarGtk-0_1-0.4.1-150400.1.10 SUSE Linux Enterprise Module for Desktop Applications 15 SP5:gnome-autoar-devel-0.4.1-150400.1.10 SUSE Linux Enterprise Module for Desktop Applications 15 SP5:libgnome-autoar-0-0-0.4.1-150400.1.10 SUSE Linux Enterprise Module for Desktop Applications 15 SP5:libgnome-autoar-gtk-0-0-0.4.1-150400.1.10 SUSE Linux Enterprise Module for Desktop Applications 15 SP5:typelib-1_0-GnomeAutoar-0_1-0.4.1-150400.1.10 SUSE Linux Enterprise Module for Desktop Applications 15 SP5:typelib-1_0-GnomeAutoarGtk-0_1-0.4.1-150400.1.10 SUSE Linux Enterprise Workstation Extension 12 SP5:libgnome-autoar-0-0-0.2.2-3.5.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libgnome-autoar-gtk-0-0-0.2.2-3.5.1 openSUSE Leap 15.2:gnome-autoar-devel-0.2.3-lp152.4.3.1 openSUSE Leap 15.2:libgnome-autoar-0-0-0.2.3-lp152.4.3.1 openSUSE Leap 15.2:libgnome-autoar-gtk-0-0-0.2.3-lp152.4.3.1 openSUSE Leap 15.2:typelib-1_0-GnomeAutoar-0_1-0.2.3-lp152.4.3.1 openSUSE Leap 15.2:typelib-1_0-GnomeAutoarGtk-0_1-0.2.3-lp152.4.3.1 openSUSE Leap 15.3:libgnome-autoar-0-0-0.2.3-3.3.1 openSUSE Leap 15.3:libgnome-autoar-gtk-0-0-0.2.3-3.3.1 openSUSE Leap 15.4:libgnome-autoar-0-0-0.4.1-150400.1.10 openSUSE Leap 15.4:libgnome-autoar-gtk-0-0-0.4.1-150400.1.10 openSUSE Tumbleweed:gnome-autoar-devel-0.4.0-1.3 openSUSE Tumbleweed:libgnome-autoar-0-0-0.4.0-1.3 openSUSE Tumbleweed:libgnome-autoar-gtk-0-0-0.4.0-1.3 openSUSE Tumbleweed:typelib-1_0-GnomeAutoar-0_1-0.4.0-1.3 openSUSE Tumbleweed:typelib-1_0-GnomeAutoarGtk-0_1-0.4.0-1.3 low 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L