CVE-2018-1000801: debian debian_linux Path Traversal

Vulnerability summary

CVE-2018-1000801 is a medium (CVSS 5.5) Path Traversal vulnerability in debian debian_linux. EPSS estimates a 1.83% chance of exploitation in the next 30 days, higher than 78.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-09-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

okular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" in "core/document.cpp" that can result in Arbitrary file creation on the user workstation. This attack appear to be exploitable via he victim must open a specially crafted Okular archive. This issue appears to have been corrected in version 18.08.1

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.