CVE-2022-48579

2023-08-0704:15:12

Debian Security Bug Tracker

security-tracker.debian.org

unrar vulnerability

symlink extraction

unix

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

37.3%

JSON

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

OSVersionArchitecturePackageVersionFilename
Debian12allunrar-nonfree< 1:6.2.3-1unrar-nonfree_1:6.2.3-1_all.deb
Debian11allunrar-nonfree< 1:6.0.3-1+deb11u2unrar-nonfree_1:6.0.3-1+deb11u2_all.deb
Debian10allunrar-nonfree< 1:5.6.6-1+deb10u3unrar-nonfree_1:5.6.6-1+deb10u3_all.deb
Debian999allunrar-nonfree< 1:6.2.3-1unrar-nonfree_1:6.2.3-1_all.deb
Debian13allunrar-nonfree< 1:6.2.3-1unrar-nonfree_1:6.2.3-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	unrar-nonfree	< 1:6.2.3-1	unrar-nonfree_1:6.2.3-1_all.deb
Debian	11	all	unrar-nonfree	< 1:6.0.3-1+deb11u2	unrar-nonfree_1:6.0.3-1+deb11u2_all.deb
Debian	10	all	unrar-nonfree	< 1:5.6.6-1+deb10u3	unrar-nonfree_1:5.6.6-1+deb10u3_all.deb
Debian	999	all	unrar-nonfree	< 1:6.2.3-1	unrar-nonfree_1:6.2.3-1_all.deb
Debian	13	all	unrar-nonfree	< 1:6.2.3-1	unrar-nonfree_1:6.2.3-1_all.deb