CVE-2015-0557

{"id": "CVE-2015-0557", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-04-08T18:59:04.890", "references": [{"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html", "source": "security@debian.org"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html", "source": "security@debian.org"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html", "source": "security@debian.org"}, {"url": "http://www.debian.org/security/2015/dsa-3213", "source": "security@debian.org"}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:201", "source": "security@debian.org"}, {"url": "http://www.openwall.com/lists/oss-security/2015/01/03/5", "source": "security@debian.org"}, {"url": "http://www.openwall.com/lists/oss-security/2015/01/05/9", "source": "security@debian.org"}, {"url": "http://www.securityfocus.com/bid/71895", "source": "security@debian.org"}, {"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774435", "tags": ["Exploit"], "source": "security@debian.org"}, {"url": "https://security.gentoo.org/glsa/201612-15", "source": "security@debian.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive."}, {"lang": "es", "value": "El archivador de c\u00f3digo abierto ARJ 3.10.22 no elimina correctamente barras oblicuas de inicio de las rutas, lo que permite a atacantes remotos realizar ataques del recorrido del directorio absoluto y escribir a ficheros arbitrarios a trav\u00e9s de m\u00faltiples barra oblicuas de inicio en una ruta en un archivo ARJ."}], "lastModified": "2017-07-01T01:29:13.047", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arj_software:arj_archiver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10FB609E-F842-4F2B-BD6E-9D6CD1968E82", "versionEndIncluding": "3.10.22"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF47C9F0-D8DA-4B55-89EB-9B2C9383ADB9"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56BDB5A0-0839-4A20-A003-B8CD56F48171"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38"}], "operator": "OR"}]}], "sourceIdentifier": "security@debian.org"}