Stay Secure with the Latest Linux Advisories

security advisorymedium severityarbitrary file overwrite

Arch Linux: ASA-202106-40 High: Fuzzywuzzy Potential Code Injection

The package thefuck before version 3.31-1 is vulnerable to arbitrary file overwrite. . Arch Linux Security Advisory ASA-202106-39 ========================================= Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2021-34363 Package : thefuck Type : arbitrary file overwrite Remote : No Link : https://security.archlinux.org/AVG-2062 Summary ====== The package thefuck before version 3.31-1 is vulnerable to arbitrary file overwrite. Resolution ========= Upgrade to 3.31-1. # pacman -Syu "thefuck> =3.31-1" The problem has been fixed upstream in version 3.31. Workaround ========= None. Description ========== The thefuck package before 3.31 allows path traversal that leads to arbitrary file deletion via the "undo archive operation" feature. Impact ===== An attacker could delete arbitrary files by tricking a user to use the "undo archive operation" feature on a crafted archive file. References ========= https://vuln.ryotak.me/advisories/48 https://github.com/nvbn/thefuck/commit/e343c577cd7da4d304b837d4a07ab4df1e023092 https://security.archlinux.org/CVE-2021-34363 . Arch Linux Advisory: ASA-202106-39 reports Medium severity for thefuck package allowing arbitrary file overwrite.. Arch Linux, Thefuck Package, Security Advisory. . Severity: Medium. LinuxSecurity.com Team

Jun 17, 2021 •Medium ArchLinux