CVE-2016-6232

Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename in an archive file, related to KNewsstuff downloads.

• CWE-22

• http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00023.html
• http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00000.html
• http://www.debian.org/security/2016/dsa-3643
• http://www.openwall.com/lists/oss-security/2016/07/16/2
• http://www.openwall.com/lists/oss-security/2016/07/16/3Third Party Advisory
• http://www.securityfocus.com/bid/91806
• http://www.ubuntu.com/usn/USN-3042-1Patch
• https://quickgit.kde.org/?p=karchive.git&a=commit&h=0cb243f64eef45565741b27364cece7d5c349c37
• https://usn.ubuntu.com/4100-1/
• https://www.kde.org/info/security/advisory-20160724-1.txtExploit, Mitigation, Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00023.html
• http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00000.html
• http://www.debian.org/security/2016/dsa-3643
• http://www.openwall.com/lists/oss-security/2016/07/16/2
• http://www.openwall.com/lists/oss-security/2016/07/16/3Third Party Advisory
• http://www.securityfocus.com/bid/91806
• http://www.ubuntu.com/usn/USN-3042-1Patch
• https://quickgit.kde.org/?p=karchive.git&a=commit&h=0cb243f64eef45565741b27364cece7d5c349c37
• https://usn.ubuntu.com/4100-1/
• https://www.kde.org/info/security/advisory-20160724-1.txtExploit, Mitigation, Vendor Advisory

Published

Aug 2, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6217Cross-site scripting (XSS) vulnerability in Sophos PureMessa…
• CVE-2016-6220Information Disclosure vulnerability in the Dashboard and Er…7.5
• CVE-2016-6223The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in tif_…
• CVE-2016-6224ecryptfs-setup-swap in eCryptfs does not prevent the unencry…
• CVE-2016-6225xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before …
• CVE-2016-6231Kaspersky Safe Browser iOS before 1.7.0 does not verify X.50…
• CVE-2016-6233The (1) order and (2) group methods in Zend_Db_Select in the…
• CVE-2016-6234The process_file function in lepton/jpgcoder.cc in Dropbox l…
• CVE-2016-6235The setup_imginfo_jpg function in lepton/jpgcoder.cc in Drop…
• CVE-2016-6236The setup_imginfo_jpg function in lepton/jpgcoder.cc in Drop…
• CVE-2016-6237The build_huffcodes function in lepton/jpgcoder.cc in Dropbo…
• CVE-2016-6238The write_ujpg function in lepton/jpgcoder.cc in Dropbox lep…