« Volver al listado

CVE-2015-0556

Estado: ModificadaMedia (5.8)—

Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

ARJ Software — ARJ ArchiverFedoraproject — Fedora

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-0556",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security@debian.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-04-08T18:59:03.797",
  "references": [
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html",
      "source": "security@debian.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html",
      "source": "security@debian.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.debian.org/security/2015/dsa-3213",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:201",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/01/03/5",
      "tags": [
        "Exploit"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/01/05/9",
      "tags": [
        "Exploit"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/71860",
      "source": "security@debian.org"
    },
    {
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774434",
      "tags": [
        "Exploit"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201612-15",
      "source": "security@debian.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2015/dsa-3213",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:201",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/01/03/5",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/01/05/9",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/71860",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774434",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201612-15",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive."
    },
    {
      "lang": "es",
      "value": "El archivador de código abierto ARJ 3.10.22 permite a atacantes remotos realizar ataques de salto de directorio a través de un ataque de enlace simbólico en un archivo ARJ."
    }
  ],
  "lastModified": "2026-06-17T00:20:31.207",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:arj_software:arj_archiver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10FB609E-F842-4F2B-BD6E-9D6CD1968E82",
              "versionEndIncluding": "3.10.22"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF47C9F0-D8DA-4B55-89EB-9B2C9383ADB9"
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56BDB5A0-0839-4A20-A003-B8CD56F48171"
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@debian.org"
}