Gnome File-Roller vulnerabilities

3 CVEs affecting Gnome File-Roller, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-36314, published 2021-04-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-16680, published 2019-09-21. Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days. An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.
CVE-2020-11736, published 2020-04-13. Low severity, CVSS 3.9. EPSS: 0.8% chance of exploitation in the next 30 days. fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the…
CVE-2020-36314, published 2021-04-07. Low severity, CVSS 3.9. EPSS: 0.6% chance of exploitation in the next 30 days. fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's…