Secunia

A vulnerability has been reported in various archivers, which can be exploited by malicious people to cause files to be extracted to arbitrary locations on a user's system.

The vulnerability is caused due to missing validation of filenames included in tar archives (and in certain cases other archives). This can be exploited to create and potentially overwrite arbitrary files on a user's system with the user's privileges when the user extracts a specially crafted archive with vulnerable software.

The problem is that filenames may contain directory traversal character sequences like "../" or in certain cases absolute paths.

Solution
cpio:
Further details available in Customer Area

Provided and/or discovered by
Florian Schafferhans

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area