« Volver al listado

CVE-2015-0557

Estado: ModificadaMedia (5.8)—

Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

ARJ Software — ARJ ArchiverFedoraproject — Fedora

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-0557",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security@debian.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-04-08T18:59:04.890",
  "references": [
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html",
      "source": "security@debian.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html",
      "source": "security@debian.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.debian.org/security/2015/dsa-3213",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:201",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/01/03/5",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/01/05/9",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/71895",
      "source": "security@debian.org"
    },
    {
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774435",
      "tags": [
        "Exploit"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201612-15",
      "source": "security@debian.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2015/dsa-3213",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:201",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/01/03/5",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/01/05/9",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/71895",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774435",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201612-15",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive."
    },
    {
      "lang": "es",
      "value": "El archivador de código abierto ARJ 3.10.22 no elimina correctamente barras oblicuas de inicio de las rutas, lo que permite a atacantes remotos realizar ataques del recorrido del directorio absoluto y escribir a ficheros arbitrarios a través de múltiples barra oblicuas de inicio en una ruta en un archivo ARJ."
    }
  ],
  "lastModified": "2026-06-17T00:20:31.333",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:arj_software:arj_archiver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10FB609E-F842-4F2B-BD6E-9D6CD1968E82",
              "versionEndIncluding": "3.10.22"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF47C9F0-D8DA-4B55-89EB-9B2C9383ADB9"
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56BDB5A0-0839-4A20-A003-B8CD56F48171"
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@debian.org"
}