Ark was found to allow arbitrary file overwrite, possibly allowing arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| kde-apps/ark | * | < 20.04.3-r2 | >= 20.04.3-r2 |
Ark is a graphical file compression/decompression utility with support for multiple formats.
KDE Ark did not fully verify symlinks contained within tar archives.
A remote attacker could entice a user to open a specially crafted tar archive using KDE Ark, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All KDE Ark users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=kde-apps/ark-20.04.3-r2"
Ark was found to allow arbitrary file overwrite, possibly allowing arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| kde-apps/ark | * | < 20.04.3-r2 | >= 20.04.3-r2 |
Ark is a graphical file compression/decompression utility with support for multiple formats.
It was discovered that Ark incorrectly handled symbolic links in tar archive files.
A remote attacker could entice a user to open a specially crafted archive using Ark, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All KDE Ark users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=kde-apps/ark-20.04.3-r2"
Ark was found to allow arbitrary file overwrite, possibly allowing arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| kde-apps/ark | * | < 20.04.3-r1 | >= 20.04.3-r1 |
Ark is a graphical file compression/decompression utility with support for multiple formats.
A maliciously crafted archive with “../” in the file path(s) could install files anywhere in the user’s home directory upon extraction.
A remote attacker could entice a user to open a specially crafted archive using Ark, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
Avoid opening untrusted archives.
All Ark users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=kde-apps/ark-20.04.3-r1"
A vulnerability in Ark might allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| kde-apps/ark | * | < 16.08.3-r1 | >= 16.08.3-r1 |
Ark is a graphical file compression/decompression utility with support for multiple formats.
A vulnerability was discovered in how Ark handles executable files while browsing a compressed archive. A user could unintentionally execute a malicious script which has the executable bit set inside of the archive. This is due to Ark not displaying what files are executable and running the associated applications for the file type upon execution.
A remote attacker, by coercing a user to browse a malicious archive file within Ark and execute certain files, could execute arbitrary code with the privileges of the user.
There is no known workaround at this time.
All Ark users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=kde-apps/ark-16.08.3-r1"