CVE-2020-16116

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Aug 3, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-161175.9In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an inCVE-2020-161187.5In GNOME Balsa before 2.6.0, a malicious server operator or man in the middle can trigger a NULL pointer dereference and client crash by senCVE-2020-161197.8Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_CVE-2020-161204.4Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namesCVE-2020-161213.3PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that CVE-2020-161227.8PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the coCVE-2020-161234.7An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection fromCVE-2020-161249.8Integer Overflow or Wraparound vulnerability in the XML RPC library of OpenRobotics ros_comm communications packages allows unauthenticated CVE-2020-161256.8gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely CVE-2020-161263.3An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped tCVE-2020-161275.5An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounCVE-2020-161283.8The aptdaemon DBus interface disclosed file existence disclosure by setting Terminal/DebconfSocket properties, aka GHSL-2020-192 and GHSL-20