Vulnerability · Published Dec 27, 2023 · Assigned by GitHub_M

CVE-2023-50255Zip Path Traversal in Deepin-Compressor

Critical 9.3

In plain English

A critical-severity path traversal in developer-center from linuxdeepin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)1.1%top 35.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
linuxdeepin	developer-center	< 5.12.21

Weakness: CWE-23, CWE-26, CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References

https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-rw5r-8p9h-3gp2 x_refsource_CONFIRM
https://github.com/linuxdeepin/deepin-compressor/commit/82f668c78c133873f5094cfab6e4eabc0b70e4b6 x_refsource_MISC