CVE-2019-13241
Publication date 4 July 2019
Last updated 25 August 2025
Ubuntu priority
Description
FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
From the Ubuntu Security Team
Mike Salvatore discovered that FlightCrew mishandled certain malformed EPUB files. An attacker could use this vulnerability to write arbitrary files to the filesystem.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| flightcrew | ||
| 18.04 LTS bionic |
Fixed in 0.7.2+dfsg-10ubuntu0.1
|
|
| 16.04 LTS xenial |
Fixed in 0.7.2+dfsg-6ubuntu0.1
|
|
| 14.04 LTS trusty | Not in release |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
7.8 · High
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-4055-1
- flightcrew vulnerabilities
- 15 July 2019