Ubuntu 20.04 LTS: USN-4482-1 Moderate: Ark File Handling Issue

ubuntu

September 1, 2020

Ark could be made to write files as your login if it opened a specially crafted file.

Summary

Ark could be made to write files as your login if it opened a specially

crafted file.

Software Description:

- ark: archive utility

Details:

Fabian Vogt discovered that Ark incorrectly handled symbolic links in

tar archive files. An attacker could use this to construct a malicious

tar archive that, when opened, would create files outside the extraction

directory.

Topics Covered

security advisory file handling symlink issue ubuntu ark

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  ark                             4:19.12.3-0ubuntu1.2

Ubuntu 18.04 LTS:
  ark                             4:17.12.3-0ubuntu1.2

Ubuntu 16.04 LTS:
  ark                             4:15.12.3-0ubuntu1.2

In general, a standard system update will make all the necessary changes.