CVE-2022-48579
Fixed in a distro release EPSS <1%
UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.
Products: rarlab unrar
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | unrar-nonfree | 1:5.6.6-1+deb10u3 |
| Debian 12 | unrar-nonfree | 1:6.2.3-1 |
| Debian 13 | unrar-nonfree | 1:6.2.3-1 |
| Debian 14 | unrar-nonfree | 1:6.2.3-1 |
| Ubuntu 16.04 LTS | unrar-nonfree | no fix |
| Ubuntu 18.04 LTS | unrar-nonfree | no fix |
| Ubuntu 20.04 LTS | unrar-nonfree | 1:5.6.6-2ubuntu0.1 |
| Ubuntu 22.04 LTS | unrar-nonfree | 1:6.1.5-1ubuntu0.1 |