USN-4733-2
gnome-autoar regression
USN-4733-1 fixed a vulnerability in GNOME Autoar. The upstream fix introduced a regression when extracting archives containing directories. This update fixes the problem.
Original advisory details:
Yiğit Can Yılmaz discovered that GNOME Autoar could extract files outside of the intended directory. If a user were tricked into extracting a specially crafted archive, a remote attacker could create files in arbitrary locations, possibly leading to code execution.
What each source reports
OSV No score
gnome-autoar regression
USN-4733-1 fixed a vulnerability in GNOME Autoar. The upstream fix introduced a regression when extracting archives containing directories. This update fixes the problem.
Original advisory details:
Yiğit Can Yılmaz discovered that GNOME Autoar could extract files outside of the intended directory. If a user were tricked into extracting a specially crafted archive, a remote attacker could create files in arbitrary locations, possibly leading to code execution.
- Record
USN-4733-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnome-autoarUbuntu:18.04:LTS |
before 0.2.3-1ubuntu0.2, plus listed versions 0.2.2-10.2.2-20.2.2-30.2.3-10.2.3-1ubuntu0.1 |
0.2.3-1ubuntu0.2 |
gnome-autoarUbuntu:20.04:LTS |
before 0.2.3-2ubuntu0.2, plus listed versions 0.2.3-20.2.3-2ubuntu0.1 |
0.2.3-2ubuntu0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-4733-2 is a vulnerability with no CVSS score yet in gnome-autoar, published March 8, 2021. No source lists public exploit code. Fixed in gnome-autoar 0.2.3-1ubuntu0.2.