Joined: 12 May 2004
|Posted: Tue Oct 20, 2020 2:26 pm Post subject: [ GLSA 202010-06 ] Ark
|Gentoo Linux Security Advisory
Title: Ark: Arbitrary code execution (GLSA 202010-06)
Exploitable: local, remote
Ark was found to allow arbitrary file overwrite, possibly allowing
arbitrary code execution.
Ark is a graphical file compression/decompression utility with support
for multiple formats.
Vulnerable: < 20.04.3-r2
Unaffected: >= 20.04.3-r2
Architectures: All supported architectures
It was discovered that Ark incorrectly handled symbolic links in tar
A remote attacker could entice a user to open a specially crafted
archive using Ark, possibly resulting in execution of arbitrary code with
the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All KDE Ark users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-apps/ark-20.04.3-r2"