CVE-2013-4668

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to fr-archive-libarchive.c and fr-window.c.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2013-07/0039.htmlBroken Link
http://lists.opensuse.org/opensuse-updates/2013-07/msg00095.htmlBroken Link
http://secunia.com/advisories/54351Not Applicable, Third Party Advisory
http://www.ocert.org/advisories/ocert-2013-001.htmlThird Party Advisory
http://www.securityfocus.com/bid/61008Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-1906-1Third Party Advisory
https://git.gnome.org/browse/file-roller/commit/?id=b147281293a8307808475e102a14857055f81631Patch, Third Party Advisory
http://archives.neohapsis.com/archives/bugtraq/2013-07/0039.htmlBroken Link
http://lists.opensuse.org/opensuse-updates/2013-07/msg00095.htmlBroken Link
http://secunia.com/advisories/54351Not Applicable, Third Party Advisory
http://www.ocert.org/advisories/ocert-2013-001.htmlThird Party Advisory
http://www.securityfocus.com/bid/61008Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-1906-1Third Party Advisory
https://git.gnome.org/browse/file-roller/commit/?id=b147281293a8307808475e102a14857055f81631Patch, Third Party Advisory

Timeline

Published: Jul 18, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-46695.4FortiClient before 4.3.5.472 on Windows, before 4.0.3.134 on Mac OS X, and before 4.0 on Android; FortiClient Lite before 4.3.4.461 on Windo CVE-2013-46704.3Multiple cross-site scripting (XSS) vulnerabilities in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allow CVE-2013-46716.0Cross-site request forgery (CSRF) vulnerability in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows re CVE-2013-46727.2The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 has an incorrect sudoers file, which allows local users to b CVE-2013-46735.8The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 does not properly implement RADIUS authentication, which all CVE-2013-46744.3Cross-site scripting (XSS) vulnerability in the Web Email Protection component in Symantec Encryption Management Server (formerly Symantec P CVE-2013-46764.3Multiple cross-site scripting (XSS) vulnerabilities in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allow remote atta CVE-2013-46774.3Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 uses weak permissions (Everyone: Read and Everyone: Change) for backup d CVE-2013-46782.7The NDMP protocol implementation in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allows remote authenticated users to CVE-2013-46796.6Symantec Workspace Virtualization before 6.x before 6.4.1953.0, when a virtual application layer is configured, allows local users to gain p CVE-2013-46806.4Open redirect vulnerability in Maag Form Captcha extension 2.0.0 and earlier for TYPO3 allows remote attackers to redirect users to arbitrar CVE-2013-46817.5SQL injection vulnerability in the sofortueberweisung2commerce extension before 2.0.1 for TYPO3 allows remote attackers to execute arbitrary