Gnome File-Roller vulnerabilities

CVE-2020-36314 [LOW] CVE-2020-36314: fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other softwa fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.

CVE-2020-11736 [LOW] CWE-22 CVE-2020-11736: fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extrac fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.

CVE-2019-16680 [MEDIUM] CWE-22 CVE-2019-16680: An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.

CVE-2016-7162 [HIGH] CVE-2016-7162: The _g_file_remove_directory function in file-utils The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive.

CVE-2013-4668 [MEDIUM] CVE-2013-4668: Directory traversal vulnerability in File Roller 3 Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to fr-archive-libarchive.c and fr-window.c.