Debian Security Advisory
DLA-1091-1 unrar-free -- LTS security update
- Date Reported:
- 07 Sep 2017
- Affected Packages:
- unrar-free
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2017-14120.
- More information:
-
It was discovered that there was a directory traversal vulnerability in unrar-free, a unarchiver for .rar files, where pathnames of the form "../filename" were unpacked into the parent directory.
For Debian 7
Wheezy
, this issue has been fixed in unrar-free version 1:0.0.1+cvs20071127-2+deb7u1.We recommend that you upgrade your unrar-free packages.