CVE-2020-16116

CVE-2020-16116 affects KDE Ark prior to version 20.08.0, where kerfuffle/jobs.cpp does not sanitize extraction paths, allowing a crafted archive to write outside the extraction directory via a ../ path traversal. The impact is potential writing of files outside the target directory, with follow-o...

CVE-2020-24654

KDE Ark (ark) before version 20.08.1 is vulnerable to a local privilege/fs access issue: a crafted TAR archive containing symlinks can cause files to be written outside the extraction directory, demonstrated by a write to a user’s home directory. Root cause is inadequate sanitization of extractio...