CVE-2015-0556 - Vulnerability Details - OpenCVE

Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.02093.

Key SSVC decision points have not yet been added.

Vendors	Products
Arj Software Subscribe	Arj Archiver Subscribe
Fedoraproject Subscribe	Fedora Subscribe

Configuration 1 [-]

cpe:2.3:a:arj_software:arj_archiver:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:o:fedoraproject:fedora:20:::::::*
	cpe:2.3:o:fedoraproject:fedora:21:::::::*
	cpe:2.3:o:fedoraproject:fedora:22:::::::*

No data.

No data.

Advisories

Source	ID	Title
Debian DLA	DLA-188-1	arj security update
Debian DSA	DSA-3213-1	arj security update
EUVD	EUVD-2015-0569	Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html
http://www.debian.org/security/2015/dsa-3213
http://www.mandriva.com/security/advisories?name=MDVSA-2015:201
http://www.openwall.com/lists/oss-security/2015/01/03/5
http://www.openwall.com/lists/oss-security/2015/01/05/9
http://www.securityfocus.com/bid/71860
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774434
https://security.gentoo.org/glsa/201612-15

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: debian

Published: 2015-04-08T18:00:00

Updated: 2024-08-06T04:10:11.026Z

Reserved: 2015-01-05T00:00:00

Link: CVE-2015-0556

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2015-04-08T18:59:03.797

Modified: 2025-04-12T10:46:40.837

Link: CVE-2015-0556

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-59

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-01-02T00:00:00", "descriptions": [{"lang": "en", "value": "Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-06-30T16:57:01", "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "shortName": "debian"}, "references": [{"name": "MDVSA-2015:201", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:201"}, {"name": "FEDORA-2015-5546", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html"}, {"name": "[oss-security] 20150105 Re: CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2015/01/05/9"}, {"name": "GLSA-201612-15", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201612-15"}, {"name": "[oss-security] 20150103 CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2015/01/03/5"}, {"name": "FEDORA-2015-5524", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html"}, {"name": "71860", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/71860"}, {"name": "DSA-3213", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2015/dsa-3213"}, {"name": "FEDORA-2015-5603", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774434"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@debian.org", "ID": "CVE-2015-0556", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "MDVSA-2015:201", "refsource": "MANDRIVA", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:201"}, {"name": "FEDORA-2015-5546", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html"}, {"name": "[oss-security] 20150105 Re: CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2015/01/05/9"}, {"name": "GLSA-201612-15", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201612-15"}, {"name": "[oss-security] 20150103 CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2015/01/03/5"}, {"name": "FEDORA-2015-5524", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html"}, {"name": "71860", "refsource": "BID", "url": "http://www.securityfocus.com/bid/71860"}, {"name": "DSA-3213", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2015/dsa-3213"}, {"name": "FEDORA-2015-5603", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html"}, {"name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774434", "refsource": "CONFIRM", "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774434"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T04:10:11.026Z"}, "title": "CVE Program Container", "references": [{"name": "MDVSA-2015:201", "tags": ["vendor-advisory", "x_refsource_MANDRIVA", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:201"}, {"name": "FEDORA-2015-5546", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html"}, {"name": "[oss-security] 20150105 Re: CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2015/01/05/9"}, {"name": "GLSA-201612-15", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201612-15"}, {"name": "[oss-security] 20150103 CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2015/01/03/5"}, {"name": "FEDORA-2015-5524", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html"}, {"name": "71860", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/71860"}, {"name": "DSA-3213", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2015/dsa-3213"}, {"name": "FEDORA-2015-5603", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774434"}]}]}, "cveMetadata": {"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "assignerShortName": "debian", "cveId": "CVE-2015-0556", "datePublished": "2015-04-08T18:00:00", "dateReserved": "2015-01-05T00:00:00", "dateUpdated": "2024-08-06T04:10:11.026Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:arj_software:arj_archiver:*:*:*:*:*:*:*:*", "matchCriteriaId": "10FB609E-F842-4F2B-BD6E-9D6CD1968E82", "versionEndIncluding": "3.10.22", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*", "matchCriteriaId": "FF47C9F0-D8DA-4B55-89EB-9B2C9383ADB9", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*", "matchCriteriaId": "56BDB5A0-0839-4A20-A003-B8CD56F48171", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*", "matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive."}, {"lang": "es", "value": "El archivador de c\u00f3digo abierto ARJ 3.10.22 permite a atacantes remotos realizar ataques de salto de directorio a trav\u00e9s de un ataque de enlace simb\u00f3lico en un archivo ARJ."}], "id": "CVE-2015-0556", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-04-08T18:59:03.797", "references": [{"source": "security@debian.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html"}, {"source": "security@debian.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html"}, {"source": "security@debian.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html"}, {"source": "security@debian.org", "url": "http://www.debian.org/security/2015/dsa-3213"}, {"source": "security@debian.org", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:201"}, {"source": "security@debian.org", "tags": ["Exploit"], "url": "http://www.openwall.com/lists/oss-security/2015/01/03/5"}, {"source": "security@debian.org", "tags": ["Exploit"], "url": "http://www.openwall.com/lists/oss-security/2015/01/05/9"}, {"source": "security@debian.org", "url": "http://www.securityfocus.com/bid/71860"}, {"source": "security@debian.org", "tags": ["Exploit"], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774434"}, {"source": "security@debian.org", "url": "https://security.gentoo.org/glsa/201612-15"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2015/dsa-3213"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:201"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.openwall.com/lists/oss-security/2015/01/03/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.openwall.com/lists/oss-security/2015/01/05/9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/71860"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774434"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201612-15"}], "sourceIdentifier": "security@debian.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "nvd@nist.gov", "type": "Primary"}]}