CVE-2017-12938
Fixed in a distro release EPSS 3%
UnRAR before 5.5.7 allows remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file.
Products: rarlab unrar
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | unrar-nonfree | 1:5.5.8-1 |
| Debian 13 | unrar-nonfree | 1:5.5.8-1 |
| Debian 14 | unrar-nonfree | 1:5.5.8-1 |
| SUSE Linux Enterprise Server 11 SP4 | unrar | 5.6.1-5.3.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | unrar | 5.6.1-4.5.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | unrar | 5.6.1-4.5.1 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | unrar | 5.6.1-4.5.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | unrar | 5.6.1-4.5.1 |
| SUSE Linux Enterprise Server 12 SP5 | unrar | 5.6.1-4.5.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | unrar | 5.6.1-5.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | unrar | 5.6.1-4.5.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | unrar | 5.6.1-4.5.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | unrar | 5.6.1-4.5.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | unrar | 5.6.1-4.5.1 |
| SUSE OpenStack Cloud 8 | unrar | 5.6.1-4.5.1 |
| SUSE OpenStack Cloud 9 | unrar | 5.6.1-4.5.1 |
| SUSE OpenStack Cloud Crowbar 9 | unrar | 5.6.1-4.5.1 |
| Ubuntu 16.04 LTS | unrar-nonfree | no fix |