- Vulnerability/
- USN-4461-1
USN-4461-1: Ark vulnerability
First published: Tue Aug 18 2020(Updated: )
Dominik Penner discovered that Ark did not properly sanitize zip archive files before performing extraction. An attacker could use this to construct a malicious zip archive that, when opened, would create files outside the extraction directory.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/ark | <4:19.12.3-0ubuntu1.1 | 4:19.12.3-0ubuntu1.1 |
| Ubuntu Ubuntu | =20.04 | |
| All of | ||
| ubuntu/ark | <4:17.12.3-0ubuntu1.1 | 4:17.12.3-0ubuntu1.1 |
| Ubuntu Ubuntu | =18.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Ark vulnerability?
The vulnerability ID is USN-4461-1.
What is the description of the Ark vulnerability?
Ark did not properly sanitize zip archive files before performing extraction, allowing an attacker to construct a malicious zip archive that could create files outside the extraction directory.
Which version of Ark is affected by this vulnerability?
Ark version 4:19.12.3-0ubuntu1.1 and 4:17.12.3-0ubuntu1.1 are affected.
What is the severity of the Ark vulnerability?
The severity of the vulnerability is not provided in the information.
How can I fix the Ark vulnerability?
Apply the appropriate security patch provided by Ubuntu to upgrade Ark to the fixed versions: 4:19.12.3-0ubuntu1.1 or 4:17.12.3-0ubuntu1.1.
- agent/severity
- agent/references
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/title
- agent/description
- agent/tags
- agent/event
- agent/trending
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/20.04
- version/ubuntu ubuntu/18.04