CVE-2016-6232
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows...
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename in an archive file, related to KNewsstuff downloads.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename in an archive file, related to KNewsstuff downloads.
- Record
CVE-2016-6232- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename in an archive file, related to KNewsstuff downloads.
- Record
CVE-2016-6232- Updated
- 2026-11-02
EUVDEUVD-2016-7163 No score
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename in an archive file, related to KNewsstuff downloads.
- Record
EUVD-2016-7163- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5r9j-pp34-8hph
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows...
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename in an archive file, related to KNewsstuff downloads.
- Record
GHSA-5r9j-pp34-8hph- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename in an archive file, related to KNewsstuff downloads.
- Record
CVE-2016-6232- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-6232
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename in an archive file, related to KNewsstuff downloads.
- Record
DEBIAN-CVE-2016-6232- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2016-6232
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename in an archive file, related to KNewsstuff downloads.
- Record
UBUNTU-CVE-2016-6232- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2016:1884-1 No score
Security update for karchive
This update for karchive fixes the following issues:
- CVE-2016-6232: A remote attacker could have been able to overwrite arbitrary files when tricking the user into downloading KDE extras such as wallpapers or Plasma Applets (boo#989698)
- Record
openSUSE-SU-2016:1884-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2016:2223-1 No score
Security update for karchive
This update for karchive fixes the following issues:
- CVE-2016-6232: A remote attacker could have been able to overwrite arbitrary files when tricking the user into downloading KDE extras such as wallpapers or Plasma Applets (boo#989698)
- Record
openSUSE-SU-2016:2223-1- Updated
- 2026-11-02
OSVUSN-3042-1 No score
kde4libs vulnerability
Andreas Cord-Landwehr discovered that KDE-Libs incorrectly handled extracting certain archives. If a user were tricked into extracting a specially-crafted archive, a remote attacker could use this issue to overwrite arbitrary files out of the extraction directory.
- Record
USN-3042-1- Updated
- 2026-11-02
OSVUSN-4100-1 No score
kconfig, kde4libs vulnerabilities
It was discovered that KConfig and KDE libraries have a vulnerability where an attacker could hide malicious code under desktop and configuration files. (CVE-2019-14744)
It was discovered that KConfig allows remote attackers to write to arbitrary files via a ../ in a filename in an archive file. (CVE-2016-6232)
- Record
USN-4100-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
karchiveDebian:12 |
before 5.24.0-1 | 5.24.0-1 |
karchiveDebian:13 |
before 5.24.0-1 | 5.24.0-1 |
karchiveDebian:14 |
before 5.24.0-1 | 5.24.0-1 |
kde4libsDebian:7 |
before 4:4.8.4-4+deb7u2, plus listed versions 4:4.8.4-44:4.8.4-4+deb7u1 |
4:4.8.4-4+deb7u2 |
kde4libsDebian:8 |
before 4:4.14.2-5+deb8u1, plus listed versions 4:4.14.2-5 |
4:4.14.2-5+deb8u1 |
kde4libsUbuntu:14.04:LTS |
before 4:4.13.3-0ubuntu0.3, plus listed versions 4:4.11.2-0ubuntu24:4.11.2-0ubuntu34:4.11.2-0ubuntu44:4.11.80-0ubuntu14:4.11.95-0ubuntu1 Show 18 moreShow less4:4.11.97-0ubuntu14:4.11.97-0ubuntu24:4.12.0-0ubuntu14:4.12.1-0ubuntu14:4.12.2-0ubuntu14:4.12.2-0ubuntu24:4.12.3-0ubuntu14:4.12.90-0ubuntu14:4.12.95-0ubuntu14:4.12.97-0ubuntu14:4.13.0-0ubuntu14:4.13.0-0ubuntu1.14:4.13.1-0ubuntu0.14:4.13.1-0ubuntu0.24:4.13.2a-0ubuntu0.24:4.13.2a-0ubuntu0.34:4.13.3-0ubuntu0.14:4.13.3-0ubuntu0.2 |
4:4.13.3-0ubuntu0.3 |
karchiveUbuntu:16.04:LTS |
before 5.18.0-0ubuntu1.1, plus listed versions 5.15.0-0ubuntu15.15.0-0ubuntu25.15.0-0ubuntu35.18.0-0ubuntu1 |
5.18.0-0ubuntu1.1 |
kde4libsUbuntu:16.04:LTS |
before 4:4.14.16-0ubuntu3.3, plus listed versions 4:4.14.13-0ubuntu14:4.14.13-0ubuntu24:4.14.13-0ubuntu34:4.14.13-0ubuntu44:4.14.13-0ubuntu6 Show 4 moreShow less4:4.14.16-0ubuntu14:4.14.16-0ubuntu34:4.14.16-0ubuntu3.14:4.14.16-0ubuntu3.2 |
4:4.14.16-0ubuntu3.3 |
kconfigUbuntu:16.04:LTS |
before 5.18.0-0ubuntu1.1, plus listed versions 5.15.0-0ubuntu15.15.0-0ubuntu25.18.0-0ubuntu1 |
5.18.0-0ubuntu1.1 |
kconfigUbuntu:18.04:LTS |
before 5.44.0-0ubuntu1.1, plus listed versions 5.38.0-0ubuntu15.40.0-0ubuntu15.41.0-0ubuntu15.42.0-0ubuntu15.43.0-0ubuntu15.44.0-0ubuntu1 |
5.44.0-0ubuntu1.1 |
kde4libsUbuntu:18.04:LTS |
before 4:4.14.38-0ubuntu3.1, plus listed versions 4:4.14.34-0ubuntu24:4.14.38-0ubuntu24:4.14.38-0ubuntu3 |
4:4.14.38-0ubuntu3.1 |
karchiveSUSE:Package Hub 12 SP1 |
before 5.20.0-6.1 | 5.20.0-6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-6232 is a high vulnerability (CVSS 7.5) in Canonical Ubuntu Linux, published July 18, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.43%, the 91st percentile. Fixed in karchive 5.24.0-1.
References
openwall.com/lists/oss-security/2016/07/16/3
quickgit.kde.org?p=karchive.git&a=commit&h=0cb243f64eef45565741b27364cece7d5c349c37
kde.org/info/security/advisory-20160724-1.txt
lists.opensuse.org/opensuse-security-announce/2016-07/msg00023.html
securityfocus.com/bid/91806
debian.org/security/2016/dsa-3643
Show 18 moreShow less
ubuntu.com/usn/USN-3042-1
usn.ubuntu.com/4100-1
nvd.nist.gov/vuln/detail/CVE-2016-6232
github.com/advisories/GHSA-5r9j-pp34-8hph
security-tracker.debian.org/tracker/CVE-2016-6232
ubuntu.com/security/CVE-2016-6232
git.reviewboard.kde.org/r/128185
seclists.org/oss-sec/2016/q3/78
cve.org/CVERecord?id=CVE-2016-6232
bugzilla.suse.com/989698
suse.com/security/cve/CVE-2016-6232