ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications.

The remote host is affected by the vulnerability described in GLSA-201701-69 (Ark: Unintended execution of scripts and executable files)

    A vulnerability was discovered in how Ark handles executable files while       browsing a compressed archive.  A user could unintentionally execute a       malicious script which has the executable bit set inside of the archive.
      This is due to Ark not displaying what files are executable and running       the associated applications for the file type upon execution.
  Impact :

    A remote attacker, by coercing a user to browse a malicious archive file       within Ark and execute certain files, could execute arbitrary code with       the privileges of the user.
  Workaround :

    There is no known workaround at this time.

CVE-2017-5330 ark: Unintended execution of scripts and executable files

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ark fixes the following issues :

  - CVE-2017-5330: ark could run executable scripts when     clicking on them (boo#1018648)

ID	Name	Product	Family	Severity
96855	GLSA-201701-69 : Ark: Unintended execution of scripts and executable files	Nessus	Gentoo Local Security Checks	high
96617	Fedora 25 : ark (2017-77ab791c90)	Nessus	Fedora Local Security Checks	high
96556	openSUSE Security Update : ark (openSUSE-2017-92)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-5330

high

Tenable Plugins

high

high

high