{"id":"CVE-2019-16680","details":"An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.","modified":"2026-07-08T17:56:42.270763Z","published":"2019-09-21T21:15:10.657Z","related":["SUSE-SU-2020:1088-1","SUSE-SU-2020:1557-1","openSUSE-SU-2020:0825-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"],"extracted_events":[{"introduced":"16.04"},{"last_affected":"16.04"},{"introduced":"18.04"},{"last_affected":"18.04"}],"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux"},{"cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"},{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux"}]},"references":[{"type":"ADVISORY","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767594"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00032.html"},{"type":"ADVISORY","url":"https://seclists.org/bugtraq/2019/Sep/57"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4139-1/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2019/dsa-4537"},{"type":"REPORT","url":"https://bugzilla.gnome.org/show_bug.cgi?id=794337"},{"type":"FIX","url":"https://gitlab.gnome.org/GNOME/file-roller/commit/57268e51e59b61c9e3125eb0f65551c7084297e2"},{"type":"FIX","url":"https://gitlab.gnome.org/GNOME/file-roller/commit/e8fb3e24dae711e4fb0d6777e0016cdda8787bc1"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gnome/file-roller","events":[{"introduced":"0"},{"fixed":"e8fb3e24dae711e4fb0d6777e0016cdda8787bc1"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.29.91"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:gnome:file-roller:*:*:*:*:*:*:*:*"}}],"versions":["3.29.90","3.29.1","3.28.0","3.27.91","3.27.90","3.27.1","3.26.1","3.26.0","3.25.91","3.25.1","3.24.1","3.24.0","3.23.92","3.23.91","3.22.3","3.22.2","3.22.1","3.22.0","3.21.91","3.21.90","3.20.2","3.20.1","3.20.0","3.19.91","3.19.90","3.19.1","3.16.4","3.16.3","3.16.2","3.16.1","3.16.0","3.15.92","3.15.91","3.15.90","3.15.2","3.14.1","3.15.1","3.14.0","3.13.92","3.13.91","3.13.2","3.13.1","3.12.1","3.12.0","3.11.92","3.11.91","3.11.90","3.11.5","3.11.4","3.11.3","3.11.2","3.11.1","3.10.1","3.10.0","3.9.92","3.9.91","3.9.90","3.9.4","3.9.3","3.9.2","3.9.1","3.8.1","3.8.0","3.7.92","3.7.91","3.7.90","3.7.3","3.7.2","3.7.1","3.6.2","3.6.1.1","3.6.1","3.6.0","3.5.92","3.5.91","3.5.90","3.5.4","3.5.3","3.5.2","3.5.1","3.4.2","3.4.1","3.4.0","3.3.92","3.3.91","3.3.90","3.3.3","3.3.2","3.3.1","3.2.1","3.2.0","3.1.92","3.1.91","3.1.90","3.1.2","3.1.1","3.0.2","3.0.1","FILE_ROLLER_3_0_0","FILE_ROLLER_2_91_93","FILE_ROLLER_2_91_92","FILE_ROLLER_2_91_91","FILE_ROLLER_2_91_90","FILE_ROLLER_2_91_6","FILE_ROLLER_2_91_5","FILE_ROLLER_2_91_4","FILE_ROLLER_2_91_3","FILE_ROLLER_2_91_2","FILE_ROLLER_2_91_1","FILE_ROLLER_2_91_0","FILE_ROLLER_2_32_0","FILE_ROLLER_2_31_92","FILE_ROLLER_2_31_91","FILE_ROLLER_2_31_90","FILE_ROLLER_2_31_5","FILE_ROLLER_2_31_4","FILE_ROLLER_2_31_3","FILE_ROLLER_2_31_2","FILE_ROLLER_2_31_1","FILE_ROLLER_2_30_1_1","FILE_ROLLER_2_30_1","FILE_ROLLER_2_30_0","FILE_ROLLER_2_29_92","FILE_ROLLER_2_29_91","FILE_ROLLER_2_29_90","FILE_ROLLER_2_29_5","FILE_ROLLER_2_29_4","FILE_ROLLER_2_29_3","FILE_ROLLER_2_29_2","FILE_ROLLER_2_29_1","FILE_ROLLER_2_28_1","FILE_ROLLER_2_28_0","FILE_ROLLER_2_27_92","FILE_ROLLER_2_27_91","FILE_ROLLER_2_27_90","FILE_ROLLER_2_27_3","FILE_ROLLER_2_27_2","FILE_ROLLER_2_27_1","FILE_ROLLER_2_26_1","FILE_ROLLER_2_26_0","FILE_ROLLER_2_25_92","FILE_ROLLER_2_25_91","FILE_ROLLER_2_25_90","FILE_ROLLER_2_25_2","FILE_ROLLER_2_25_1","FILE_ROLLER_2_24_2","FILE_ROLLER_2_24_1","FILE_ROLLER_2_24_0","FILE_ROLLER_2_23_92","FILE_ROLLER_2_23_91","FILE_ROLLER_2_23_6","FILE_ROLLER_2_23_5","FILE_ROLLER_2_23_4","FILE_ROLLER_2_23_3","FILE_ROLLER_2_23_2","FILE_ROLLER_2_23_1","FILE_ROLLER_2_22_0","FILE_ROLLER_2_21_92","FILE_ROLLER_2_21_91","FILE_ROLLER_2_21_2","FILE_ROLLER_2_21_1","FILE_ROLLER_2_20_2","FILE_ROLLER_2_20_1","FILE_ROLLER_2_20_0","FILE_ROLLER_2_19_92","FILE_ROLLER_2_19_91","FILE_ROLLER_2_19_90","FILE_ROLLER_2_19_4","FILE_ROLLER_2_19_3","FILE_ROLLER_2_19_2","FILE_ROLLER_2_19_1","FILE_ROLLER_2_18_0","FILE_ROLLER_2_17_92","FILE_ROLLER_2_17_91","FILE_ROLLER_2_17_90","FILE_ROLLER_2_17_5","FILE_ROLLER_2_17_4","FILE_ROLLER_2_17_3","FILE_ROLLER_2_17_2","FILE_ROLLER_2_17_1","FILE_ROLLER_2_16_1","FILE_ROLLER_2_16_0","FILE_ROLLER_2_15_93","FILE_ROLLER_2_15_92","FILE_ROLLER_2_15_91","FILE_ROLLER_2_15_90","FILE_ROLLER_2_15_1","FILE_ROLLER_2_14_3","FILE_ROLLER_2_14_2","FILE_ROLLER_2_14_1","FILE_ROLLER_2_14_0","FILE_ROLLER_2_13_92","FILE_ROLLER_2_13_91","FILE_ROLLER_2_13_90","FILE_ROLLER_2_13_4","FILE_ROLLER_2_13_2","FILE_ROLLER_2_4_0_1","start"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16680.json"}},{"ranges":[{"type":"GIT","repo":"https://gitlab.gnome.org/gnome/file-roller","events":[{"introduced":"0"},{"fixed":"e8fb3e24dae711e4fb0d6777e0016cdda8787bc1"},{"fixed":"57268e51e59b61c9e3125eb0f65551c7084297e2"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:gnome:file-roller:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.29.91"}]}}],"versions":["3.29.90","3.29.1","3.28.0","3.27.91","3.27.90","3.27.1","3.26.1","3.26.0","3.25.91","3.25.1","3.24.1","3.24.0","3.23.92","3.23.91","3.22.3","3.22.2","3.22.1","3.22.0","3.21.91","3.21.90","3.20.2","3.20.1","3.20.0","3.19.91","3.19.90","3.19.1","3.16.4","3.16.3","3.16.2","3.16.1","3.16.0","3.15.92","3.15.91","3.15.90","3.15.2","3.14.1","3.15.1","3.14.0","3.13.92","3.13.91","3.13.2","3.13.1","3.12.1","3.12.0","3.11.92","3.11.91","3.11.90","3.11.5","3.11.4","3.11.3","3.11.2","3.11.1","3.10.1","3.10.0","3.9.92","3.9.91","3.9.90","3.9.4","3.9.3","3.9.2","3.9.1","3.8.1","3.8.0","3.7.92","3.7.91","3.7.90","3.7.3","3.7.2","3.7.1","3.6.2","3.6.1.1","3.6.1","3.6.0","3.5.92","3.5.91","3.5.90","3.5.4","3.5.3","3.5.2","3.5.1","3.4.2","3.4.1","3.4.0","3.3.92","3.3.91","3.3.90","3.3.3","3.3.2","3.3.1","3.2.1","3.2.0","3.1.92","3.1.91","3.1.90","3.1.2","3.1.1","3.0.2","3.0.1","FILE_ROLLER_3_0_0","FILE_ROLLER_2_91_93","FILE_ROLLER_2_91_92","FILE_ROLLER_2_91_91","FILE_ROLLER_2_91_90","FILE_ROLLER_2_91_6","FILE_ROLLER_2_91_5","FILE_ROLLER_2_91_4","FILE_ROLLER_2_91_3","FILE_ROLLER_2_91_2","FILE_ROLLER_2_91_1","FILE_ROLLER_2_91_0","FILE_ROLLER_2_32_0","FILE_ROLLER_2_31_92","FILE_ROLLER_2_31_91","FILE_ROLLER_2_31_90","FILE_ROLLER_2_31_5","FILE_ROLLER_2_31_4","FILE_ROLLER_2_31_3","FILE_ROLLER_2_31_2","FILE_ROLLER_2_31_1","FILE_ROLLER_2_30_1_1","FILE_ROLLER_2_30_1","FILE_ROLLER_2_30_0","FILE_ROLLER_2_29_92","FILE_ROLLER_2_29_91","FILE_ROLLER_2_29_90","FILE_ROLLER_2_29_5","FILE_ROLLER_2_29_4","FILE_ROLLER_2_29_3","FILE_ROLLER_2_29_2","FILE_ROLLER_2_29_1","FILE_ROLLER_2_28_1","FILE_ROLLER_2_28_0","FILE_ROLLER_2_27_92","FILE_ROLLER_2_27_91","FILE_ROLLER_2_27_90","FILE_ROLLER_2_27_3","FILE_ROLLER_2_27_2","FILE_ROLLER_2_27_1","FILE_ROLLER_2_26_1","FILE_ROLLER_2_26_0","FILE_ROLLER_2_25_92","FILE_ROLLER_2_25_91","FILE_ROLLER_2_25_90","FILE_ROLLER_2_25_2","FILE_ROLLER_2_25_1","FILE_ROLLER_2_24_2","FILE_ROLLER_2_24_1","FILE_ROLLER_2_24_0","FILE_ROLLER_2_23_92","FILE_ROLLER_2_23_91","FILE_ROLLER_2_23_6","FILE_ROLLER_2_23_5","FILE_ROLLER_2_23_4","FILE_ROLLER_2_23_3","FILE_ROLLER_2_23_2","FILE_ROLLER_2_23_1","FILE_ROLLER_2_22_0","FILE_ROLLER_2_21_92","FILE_ROLLER_2_21_91","FILE_ROLLER_2_21_2","FILE_ROLLER_2_21_1","FILE_ROLLER_2_20_2","FILE_ROLLER_2_20_1","FILE_ROLLER_2_20_0","FILE_ROLLER_2_19_92","FILE_ROLLER_2_19_91","FILE_ROLLER_2_19_90","FILE_ROLLER_2_19_4","FILE_ROLLER_2_19_3","FILE_ROLLER_2_19_2","FILE_ROLLER_2_19_1","FILE_ROLLER_2_18_0","FILE_ROLLER_2_17_92","FILE_ROLLER_2_17_91","FILE_ROLLER_2_17_90","FILE_ROLLER_2_17_5","FILE_ROLLER_2_17_4","FILE_ROLLER_2_17_3","FILE_ROLLER_2_17_2","FILE_ROLLER_2_17_1","FILE_ROLLER_2_16_1","FILE_ROLLER_2_16_0","FILE_ROLLER_2_15_93","FILE_ROLLER_2_15_92","FILE_ROLLER_2_15_91","FILE_ROLLER_2_15_90","FILE_ROLLER_2_15_1","FILE_ROLLER_2_14_3","FILE_ROLLER_2_14_2","FILE_ROLLER_2_14_1","FILE_ROLLER_2_14_0","FILE_ROLLER_2_13_92","FILE_ROLLER_2_13_91","FILE_ROLLER_2_13_90","FILE_ROLLER_2_13_4","FILE_ROLLER_2_13_2","FILE_ROLLER_2_4_0_1","start"],"database_specific":{"vanir_signatures":[{"id":"CVE-2019-16680-0aa778df","signature_type":"Function","signature_version":"v1","source":"https://gitlab.gnome.org/gnome/file-roller@57268e51e59b61c9e3125eb0f65551c7084297e2","target":{"file":"src/glib-utils.c","function":"sanitize_filename"},"deprecated":false,"digest":{"function_hash":"27155979717750704031034549997628743833","length":444}},{"source":"https://gitlab.gnome.org/gnome/file-roller@57268e51e59b61c9e3125eb0f65551c7084297e2","target":{"file":"src/glib-utils.c"},"deprecated":false,"digest":{"line_hashes":["138656517418615610897130002064559785166","247896318390256146051722219473642331694","198896843324868053886547451836575139848","113159501639207269924903206868110738369"],"threshold":0.9},"id":"CVE-2019-16680-a60e9b0a","signature_type":"Line","signature_version":"v1"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16680.json","vanir_signatures_modified":"2026-07-08T17:56:42Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}