FreeBSD ports tree (read-only mirror)
Find a file
Tobias C. Berner 054311d725 archivers/ark: fix vulnerability in tar extraction
KDE Project Security Advisory
=============================

Title:           Ark: maliciously crafted TAR archive with symlinks can install files outside the extraction directory.
Risk Rating:     Important
CVE:             CVE-2020-24654
Versions:        ark <= 20.08.0
Author:          Elvis Angelaccio <elvis.angelaccio@kde.org>
Date:            27 August 2020

Overview
========

A maliciously crafted TAR archive containing symlink entries
would install files anywhere in the user's home directory upon extraction.

Proof of concept
================

For testing, an example of malicious archive can be found at
https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.tar

Impact
======

Users can unwillingly install files like a modified .bashrc, or a malicious
script placed in ~/.config/autostart.

Workaround
==========

Before extracting a downloaded archive using the Ark GUI, users should inspect it
to make sure it doesn't contain symlink entries pointing outside the extraction folder.

The 'Extract' context menu from the Dolphin file manager shouldn't be used.

Solution
========

Ark 20.08.1 skips maliciously crafted symlinks when extracting TAR archives.

Alternatively, 8bf8c5ef07 can be applied to previous
releases.

Credits
=======

Thanks to Fabian Vogt for reporting this issue and for fixing it.

MFH:		2020Q3
Security:	CVE-2020-24654
2020-08-28 05:47:31 +00:00
accessibility KDE's August 2020 Apps Update 2020-08-13 17:10:30 +00:00
arabic LibreOffice suite: update to 7.0.0 release 2020-08-16 12:41:23 +00:00
archivers archivers/ark: fix vulnerability in tar extraction 2020-08-28 05:47:31 +00:00
astro - Update to 1.0-2 2020-08-27 22:40:09 +00:00
audio Unbreak the build with -fno-common (Clang 11, GCC 10). 2020-08-28 02:39:38 +00:00
base Don't disable LTO for aarch64-gcc[69]. 2020-07-23 19:25:07 +00:00
benchmarks benchmarks/flowgrind: Fix build on 13-CURRENT 2020-08-24 23:56:33 +00:00
biology Remove expired ports: 2020-08-27 11:25:47 +00:00
cad cad/atlc: fix build with recent current 2020-08-27 19:13:24 +00:00
chinese LibreOffice suite: update to 7.0.0 release 2020-08-16 12:41:23 +00:00
comms comms/bladrf: fix build on recent current 2020-08-27 20:38:36 +00:00
converters converters/osm2pgrouting: fix build after databases/postgresql-libpqxx update 2020-08-22 06:50:15 +00:00
databases databases/mysql57-server: fix build on current (temporary fix) 2020-08-27 06:21:38 +00:00
deskutils deskutils/syncthingtray: update to 0.11.12 2020-08-27 17:53:29 +00:00
devel devel/blame: fix build with recent current 2020-08-27 20:47:12 +00:00
dns Garbage collect the SIGCHASE option, it was removed in 9.12. 2020-08-27 08:34:29 +00:00
editors editors/atom: fix build with recent current 2020-08-27 19:41:48 +00:00
emulators Revert r546386 now that better fix had been committed in r546699. 2020-08-28 03:39:25 +00:00
finance finance/cointop: update to 1.5.4 2020-08-25 16:56:25 +00:00
french LibreOffice suite: update to 7.0.0 release 2020-08-16 12:41:23 +00:00
ftp - Fix build with clang 11 2020-08-27 19:19:14 +00:00
games games/biniax2: fix build on recent current 2020-08-27 20:34:48 +00:00
german Update to 2020.08.23 2020-08-25 18:49:56 +00:00
graphics grahpics/acidwarp-sdl: fix build on recent current 2020-08-27 17:15:12 +00:00
hebrew LibreOffice suite: update to 7.0.0 release 2020-08-16 12:41:23 +00:00
hungarian LibreOffice suite: update to 7.0.0 release 2020-08-16 12:41:23 +00:00
irc irc/unreal: fix build on recent current 2020-08-27 16:57:53 +00:00
japanese Remove expired ports: 2020-08-27 11:25:47 +00:00
java Add a port to create JRE-only package for java/openjdk11. 2020-08-20 02:23:07 +00:00
Keywords Avoid spamming about a file that does not exist. 2020-05-14 11:29:18 +00:00
korean - Unbreak. The FTP server was restored recently. 2020-08-28 04:17:41 +00:00
lang Update to the 20200822 snapshot of GCC 10.2.1. 2020-08-27 18:27:34 +00:00
mail mail/avenger: fix build on recent current 2020-08-27 19:56:15 +00:00
math math/sleef: update to 3.4.1 2020-08-27 23:23:33 +00:00
misc Update to 10.1.0 2020-08-27 19:07:30 +00:00
Mk Fix dependency lines after r545533 2020-08-23 09:34:46 +00:00
multimedia multimedia/avinfo: fix build with recent current 2020-08-27 20:01:19 +00:00
net net/appkonference: fix build on recent current 2020-08-27 18:59:18 +00:00
net-im net-im/chatterino2: create port 2020-08-27 21:22:04 +00:00
net-mgmt net/bandwidthd: fix build on recent current 2020-08-27 20:21:04 +00:00
net-p2p - Fix build with clang 11 2020-08-27 19:30:54 +00:00
news news/sabnzbdplus: Update to 3.0.1 2020-08-19 10:21:52 +00:00
polish Update to 20200822 2020-08-25 18:50:01 +00:00
ports-mgmt ports-mgmt/pkg_replace: update to 20200821 2020-08-26 11:31:17 +00:00
portuguese LibreOffice suite: update to 7.0.0 release 2020-08-16 12:41:23 +00:00
print print/tex-luatex: fix build on recent current 2020-08-27 13:14:17 +00:00
russian LibreOffice suite: update to 7.0.0 release 2020-08-16 12:41:23 +00:00
science Update to 2.41 2020-08-27 18:43:36 +00:00
security security/vuxml: document vulnerability in ark 2020-08-28 05:15:49 +00:00
shells Update manual page to refer to ${LOCALBASE}/etc/profile instead of /etc/profile. 2020-08-24 19:03:08 +00:00
sysutils sysutils/dsbmc: Update to 1.1 2020-08-27 18:29:04 +00:00
Templates Set configure variables to "yes" instead of "1". 2020-08-04 09:03:23 +00:00
textproc textproc/asm2html: fix build on recent current 2020-08-27 19:11:32 +00:00
Tools bump_revision.pl: fix typo in help text. 2020-08-23 09:16:29 +00:00
ukrainian LibreOffice suite: update to 7.0.0 release 2020-08-16 12:41:23 +00:00
vietnamese LibreOffice suite: update to 7.0.0 release 2020-08-16 12:41:23 +00:00
www Add the corresponding library path to the patch for the 2020-08-27 23:03:40 +00:00
x11 x11/nwg-launchers: update to 0.3.2 2020-08-28 00:04:01 +00:00
x11-clocks x11-clocks/asclock-xlib: Fix build with -fno-common 2020-08-23 22:15:59 +00:00
x11-drivers x11-drivers/xf86-video-geode: Fix -fno-common 2020-08-24 20:21:07 +00:00
x11-fm - update from 4.4.0 to 4.5.0 2020-08-22 17:59:08 +00:00
x11-fonts Update to 3.4.3 2020-08-17 20:56:13 +00:00
x11-servers x11-servers/xwayland-devel: update to 1.20.0.714 2020-08-25 20:05:45 +00:00
x11-themes Remove expired ports: 2020-08-27 11:25:47 +00:00
x11-toolkits x11-toolkits/wlroots: unbreak WLR_SESSION=direct with LIBSEAT=on after r546064 2020-08-27 00:22:50 +00:00
x11-wm x11-wm/piewm: fix the build with LLVM 11 2020-08-27 14:33:29 +00:00
.arcconfig
.gitattributes
.gitauthors .gitauthors: Add Daniel Ebdrup Jensen (debdrup) 2020-07-26 11:18:25 +00:00
.gitignore
.gitmessage
CHANGES Add support for test-only dependencies in pyqt.mk 2020-05-31 09:00:47 +00:00
CONTRIBUTING.md
COPYRIGHT Happy New Year 2020! 2019-12-31 16:05:08 +00:00
GIDs Add new port: net/rpki-client 2020-07-01 18:38:02 +00:00
LEGAL Remove expired ports: 2020-08-27 11:25:47 +00:00
Makefile Retire the palm category (1999-2019) 2019-11-04 11:57:46 +00:00
MOVED - Re-add korean/hpscat. The FTP server was restored recently. 2020-08-28 03:46:41 +00:00
README
UIDs Add new port: net/rpki-client 2020-07-01 18:38:02 +00:00
UPDATING editors/emacs: Update to version 27.1 2020-08-12 18:30:06 +00:00

This is the FreeBSD Ports Collection.  For an easy to use
WEB-based interface to it, please see:

	https://www.FreeBSD.org/ports

For general information on the Ports Collection, please see the
FreeBSD Handbook ports section which is available from:

	https://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/ports.html
		for the latest official version
	or:
	The ports(7) manual page (man ports).

These will explain how to use ports and packages.

If you would like to search for a port, you can do so easily by
saying (in /usr/ports):

	make search name="<name>"
	or:
	make search key="<keyword>"

which will generate a list of all ports matching <name> or <keyword>.
make search also supports wildcards, such as:

	make search name="gtk*"

For information about contributing to FreeBSD ports, please see the Porter's
Handbook, available at:

	https://www.FreeBSD.org/doc/en_US.ISO8859-1/books/porters-handbook/

NOTE:  This tree will GROW significantly in size during normal usage!
The distribution tar files can and do accumulate in /usr/ports/distfiles,
and the individual ports will also use up lots of space in their work
subdirectories unless you remember to "make clean" after you're done
building a given port.  /usr/ports/distfiles can also be periodically
cleaned without ill-effect.