A vulnerability in GNOME File Roller could lead to a directory traversal attack.

Announced

2020-09-13

Revised

2020-09-13

Access

local, remote

Bugs

#717362

Advisory

https://security.gentoo.org/glsa/202009-06

Affected packages

Package	Arch	Vulnerable	Unaffected
app-arch/file-roller	*	< 3.36.3	>= 3.36.3

Background

File Roller is an archive manager for the GNOME desktop environment.

Description

It was discovered that GNOME File Roller incorrectly handled symlinks.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All GNOME File Roller users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-arch/file-roller-3.36.3"

References

• CVE-2020-11736