CVE-2016-7162

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-09-26 · updated 2026-06-17
Weakness: CWE-20

Description

The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04
File Roller Project File Roller: 3.5.4, 3.6.0, 3.6.1, 3.6.1.1, 3.6.2, 3.6.3 (+14)

References

http://ftp.gnome.org/mirror/gnome.org/sources/file-roller/3.20/file-roller-3.20.3.news
http://ftp.gnome.org/mirror/gnome.org/sources/file-roller/3.21/file-roller-3.21.90.news
http://www.openwall.com/lists/oss-security/2016/09/08/4
http://www.securityfocus.com/bid/92896
http://www.ubuntu.com/usn/USN-3074-1
https://bugzilla.gnome.org/show_bug.cgi?id=698554
https://git.gnome.org/browse/file-roller/commit/?id=f70be1f41688859ec8dbe266df35a1839ceb96c5
http://ftp.gnome.org/mirror/gnome.org/sources/file-roller/3.20/file-roller-3.20.3.news
http://ftp.gnome.org/mirror/gnome.org/sources/file-roller/3.21/file-roller-3.21.90.news
http://www.openwall.com/lists/oss-security/2016/09/08/4
http://www.securityfocus.com/bid/92896
http://www.ubuntu.com/usn/USN-3074-1

Get alerted when CVE-2016-7162 or the next vulnerability affects your stack