CVE catalog

CVE-2014-9983

rar: CVE-2014-9983

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.77% · Oct 27, 2026

Directory Traversal exists in RAR 4.x and 5.x because an unpack operation follows any symlinks, including symlinks contained in the archive. This allows remote attackers to write to arbitrary files via a crafted archive.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrarsid2:7.23-1fixed
Debianrarforky2:7.23-1fixed
Debianrartrixie2:7.11-1fixed
Debianrarbookworm2:7.01-1~deb12u1fixed
Ubunturar16.042:5.3.b2-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrarsourcesid2:5.3.b2-1not yet assignedNot reported[774172]
Debianrarsourceforky2:5.3.b2-1not yet assignedNot reported[774172]
Debianrarsourcetrixie2:5.3.b2-1not yet assignedNot reported[774172]
Debianrarsourcebookworm2:5.3.b2-1not yet assignedNot reported[774172]
Ubunturardeb16.042:5.3.b2-1Not reportedUBUNTU-CVE-2014-9983Not reported

[Debian bug #774172]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [rar]Fixed
    Details (1)

    • 2:7.01-1~deb12u1 · amd64 · bookworm

      Fixed · Fixed: 2:5.3.b2-1

      dsa · rar · debian · bookworm; dsa · rar · debian · 12

[Debian 13 (Trixie)]

  • [rar]Fixed
    Details (1)

    • 2:7.11-1 · amd64 · trixie

      Fixed · Fixed: 2:5.3.b2-1

      dsa · rar · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]