CVE-2020-24654 Common Vulnerabilities and Exposures

Upstream information

CVE-2020-24654 at MITRE

Description

In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
CVSS detail	National Vulnerability Database
Base Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
Access Vector	Network
Access Complexity	Medium
Authentication	None
Confidentiality Impact	None
Integrity Impact	Partial
Availability Impact	None

CVSS v3 Scores
CVSS detail	National Vulnerability Database
Base Score	3.3
Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack Vector	Local
Attack Complexity	Low
Privileges Required	None
User Interaction	Required
Scope	Unchanged
Confidentiality Impact	None
Integrity Impact	Low
Availability Impact	None
CVSSv3 Version	3.1

SUSE Bugzilla entry: 1175857 [RESOLVED / FIXED]

SUSE Security Advisories:

openSUSE-SU-2020:1310-1, published Thu Dec 7 12:55:40 2023
openSUSE-SU-2020:1310-2, published Thu Dec 7 12:55:40 2023

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Package Hub 15 SP1	`ark >= 18.12.3-bp151.3.6.1` `ark-lang >= 18.12.3-bp151.3.6.1` `libkerfuffle18 >= 18.12.3-bp151.3.6.1` `libkerfuffle20 >= 20.04.2-lp152.2.6.1`	Patchnames: openSUSE-2020-1310
SUSE Package Hub 15 SP2	`ark >= 20.04.2-bp152.2.6.1` `ark-lang >= 20.04.2-bp152.2.6.1` `libkerfuffle18 >= 18.12.3-bp151.3.6.1` `libkerfuffle20 >= 20.04.2-bp152.2.6.1`	Patchnames: openSUSE-2020-1310
openSUSE Leap 15.1	`ark >= 18.12.3-lp151.2.7.1` `ark-lang >= 18.12.3-lp151.2.7.1` `libkerfuffle18 >= 18.12.3-lp151.2.7.1`	Patchnames: openSUSE-2020-1310
openSUSE Leap 15.2	`ark >= 20.04.2-lp152.2.6.1` `ark-lang >= 20.04.2-lp152.2.6.1` `libkerfuffle18 >= 18.12.3-lp151.2.7.1` `libkerfuffle20 >= 20.04.2-lp152.2.6.1`	Patchnames: openSUSE-2020-1310
openSUSE Leap 15.3	`ark >= 20.04.2-bp153.2.25` `ark-lang >= 20.04.2-bp153.2.25` `libkerfuffle20 >= 20.04.2-bp153.2.25`	Patchnames: openSUSE Leap 15.3 GA ark-20.04.2-bp153.2.25
openSUSE Leap 15.4	`ark >= 21.12.3-bp154.1.34` `ark-lang >= 21.12.3-bp154.1.34` `libkerfuffle21 >= 21.12.3-bp154.1.34`	Patchnames: openSUSE Leap 15.4 GA ark-21.12.3-bp154.1.34
openSUSE Tumbleweed	`ark >= 21.08.1-1.2` `ark-lang >= 21.08.1-1.2` `libkerfuffle21 >= 21.08.1-1.2`	Patchnames: openSUSE-Tumbleweed-2024-10632

SUSE Timeline for this CVE

CVE page created: Thu Aug 27 22:13:37 2020
CVE page last modified: Mon Oct 6 19:26:37 2025