USN-4937-2
gnome-autoar regression
USN-4937-1 fixed a vulnerability in GNOME Autoar. The update caused a regression when extracting certain archives. This update fixes the problem.
Original advisory details:
Ondrej Holy discovered that GNOME Autoar could extract files outside of the intended directory. If a user were tricked into extracting a specially crafted archive, a remote attacker could create files in arbitrary locations, possibly leading to code execution.
What each source reports
OSV No score
gnome-autoar regression
USN-4937-1 fixed a vulnerability in GNOME Autoar. The update caused a regression when extracting certain archives. This update fixes the problem.
Original advisory details:
Ondrej Holy discovered that GNOME Autoar could extract files outside of the intended directory. If a user were tricked into extracting a specially crafted archive, a remote attacker could create files in arbitrary locations, possibly leading to code execution.
- Record
USN-4937-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnome-autoarUbuntu:18.04:LTS |
before 0.2.3-1ubuntu0.4, plus listed versions 0.2.2-10.2.2-20.2.2-30.2.3-10.2.3-1ubuntu0.10.2.3-1ubuntu0.20.2.3-1ubuntu0.3 |
0.2.3-1ubuntu0.4 |
gnome-autoarUbuntu:20.04:LTS |
before 0.2.3-2ubuntu0.4, plus listed versions 0.2.3-20.2.3-2ubuntu0.10.2.3-2ubuntu0.20.2.3-2ubuntu0.3 |
0.2.3-2ubuntu0.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-4937-2 is a vulnerability with no CVSS score yet in gnome-autoar, published June 7, 2021. No source lists public exploit code. Fixed in gnome-autoar 0.2.3-1ubuntu0.4.