A vulnerability has been identified in Midnight Commander (mc), which potentially can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error when handling symlinks in compressed files. This can be exploited by constructing a compressed file containing overly long, specially crafted symlinks. This will cause a stack overflow when a user tries to view the content of the malicious compressed file using mc.

The vulnerability has been confirmed in version 4.5.55 but should reportedly affect versions 4.5.52 through 4.6.0.

Solution
Don't use mc to view the contents of untrusted compressed files.

Provided and/or discovered by
Ilya Teterin

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area