CVE:CVE-2020-16116
CNNVD:CNNVD-202008-002
KDE Ark是KDE社区的一款图形文件压缩/解压缩实用程序。
KDE Ark 20.08.0之前版本中的kerfuffle/jobs.cpp文件存在安全漏洞。攻击者可借助‘../’目录遍历序列利用该漏洞在提取目录之外安装文件。
solution:Upgrade kde ark to a higher version than 20.08.0,and avoid the version (,20.08.0); Upgrade debian debian_linux to a higher version than 9.0,10.0,and avoid the version 9.0,10.0; Upgrade fedoraproject fedora to a higher version than 31,32,and avoid the version 31,32; Upgrade opensuse leap to a higher version than 15.1,15.2,and avoid the version 15.1,15.2; Upgrade canonical ubuntu_linux to a higher version than 18.04,20.04,and avoid the version 18.04,20.04