CVE-2011-2725: Path Traversal
A path traversal flaw was found in the way Ark, the tool for managing various archive formats within the KDE environment, processed certain Zip archives. A remote attacker could provide a specially-crafted Zip archive, which once opened in the Ark GUI frontend would lead to arbitrary file being opened or, potentially, if the local victim provided correct user credentials could allow that file to be removed.
References: [1] http://www.openwall.com/lists/oss-security/2011/07/25/9 [2] https://bugzilla.novell.com/showbug.cgi?id=708268
Other sources
Directory traversal vulnerability in Ark 4.7.x and earlier allows remote attackers to delete and force the display of arbitrary files via .. (dot dot) sequences in a zip file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2725?
CVE-2011-2725 is classified as a medium severity vulnerability due to the potential for arbitrary file access.
Which versions of KDE SC are affected by CVE-2011-2725?
CVE-2011-2725 affects KDE SC versions up to 4.7.4, including specific versions 4.7.0 through 4.7.3.
How do I fix CVE-2011-2725?
To fix CVE-2011-2725, users should update their KDE SC to a fixed version beyond 4.7.4 or apply any available patches.
Can CVE-2011-2725 be exploited remotely?
Yes, an attacker can exploit CVE-2011-2725 remotely by crafting a malicious Zip archive that, when opened, accesses arbitrary files.
What software does CVE-2011-2725 affect?
CVE-2011-2725 primarily affects KDE Ark and various versions of KDE SC within the KDE environment.