Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 657778

Summary: dev-lang/perl: CVE-2018-12015: Archive::Tar: directory traversal vulnerability
Product: Gentoo Security Reporter: Ian Zimmerman <nobrowser>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: normal CC: kentnl
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Package list:
Runtime testing required: ---

Description Ian Zimmerman 2018-06-11 00:44:13 UTC
Quoting $URL:

> By default, the Archive::Tar module doesn't allow extracting files
> outside the current working directory. However, you can bypass this
> secure extraction mode easily by putting a symlink and a regular file
> with the same name into the tarball.
Comment 1 Kent Fredric (IRC: kent\n) (RETIRED) gentoo-dev 2018-06-16 04:36:58 UTC

*** This bug has been marked as a duplicate of bug 657968 ***