Threats tagged 'ghsa-2qrp-jmvp-2795'

A directory traversal vulnerability exists in version 3.0 of the quilt source package unpacking process. The issue arises when the packaging tarball contains the quilt database directory (.pc) with attacker-controlled symbolic links. If patches fail to apply, the code responsible for restoring backup files may be tricked into modifying or deleting files pointed to by these malicious symlinks.