Ubuntu 21.04 USN-4937-2 Critical: GNOME Autoar Extraction Issue

ubuntu

June 7, 2021

USN-4937-1 introduced a regression in GNOME Autoar.

Summary

USN-4937-1 introduced a regression in GNOME Autoar.

Software Description:

- gnome-autoar: Archive integration support for GNOME

Details:

USN-4937-1 fixed a vulnerability in GNOME Autoar. The update caused a

regression when extracting certain archives. This update fixes the problem.

Original advisory details:

Ondrej Holy discovered that GNOME Autoar could extract files outside of the

intended directory. If a user were tricked into extracting a specially

crafted archive, a remote attacker could create files in arbitrary

locations, possibly leading to code execution.

Topics Covered

security advisory code execution ubuntu extraction issue gnome-autoar

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.04:
  libgnome-autoar-0-0             0.3.1-1ubuntu0.1
  libgnome-autoar-gtk-0-0         0.3.1-1ubuntu0.1

Ubuntu 20.10:
  libgnome-autoar-0-0             0.2.4-2ubuntu0.4
  libgnome-autoar-gtk-0-0         0.2.4-2ubuntu0.4

Ubuntu 20.04 LTS:
  libgnome-autoar-0-0             0.2.3-2ubuntu0.4
  libgnome-autoar-gtk-0-0         0.2.3-2ubuntu0.4

Ubuntu 18.04 LTS:
  libgnome-autoar-0-0             0.2.3-1ubuntu0.4
  libgnome-autoar-gtk-0-0         0.2.3-1ubuntu0.4

After a standard system update you need to restart your session to make all
the necessary changes.