CVE-2019-16680

file-roller: File Roller is an application for creating and viewing archives files, such as tar or zip files. Security Fix(es):...

CVE-2019-16680 is fixed in file-roller on 1 platform, first by file-roller 3.28.0-1ubuntu1.1, released September 20, 2019. It is not reported as exploited. Patch Radar priority: Routine.

Routine
CVSS
4.3
Moderate
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0213
82nd percentile

File Roller is an application for creating and viewing archives files, such as tar or zip files. Security Fix(es): * file-roller: path traversal vulnerability via a specially crafted filename contained in malicious archive (CVE-2019-16680) * file-roller: directory traversal via directory symlink pointing outside of the target directory (CVE-2020-11736) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

Where it's fixed

ProductFixed inFixReleased
Linux
file-roller · RHEL 8 0:3.28.1-3.el8 RHSA-2020:4820 Nov 4, 2020
file-roller · Ubuntu 18.04.6 LTS (bionic) 3.28.0-1ubuntu1.1 file-roller 3.28.0-1ubuntu1.1 Sep 20, 2019
file-roller · ol 8 0:3.28.1-3.el8 ELSA-2020-4820 Nov 10, 2020