Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6.4
CVSSv2

CVE-2015-2304

Published: 15/03/2015 Updated: 07/11/2023
CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10
VMScore: 570
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P
Subscribe to Libarchive

Vulnerability Summary

Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and previous versions allows remote malicious users to write to arbitrary files via a full pathname in an archive.

Vulnerable Product Search on Vulmon Subscribe to Product

libarchive libarchive

canonical ubuntu linux 12.04

canonical ubuntu linux 14.10

canonical ubuntu linux 14.04

opensuse opensuse 13.1

opensuse opensuse 13.2

Vendor Advisories

Ubuntu Security Notice: libarchive vulnerabilities
libarchive could be made to crash or overwrite files ...
Debian Security Advisories: DSA-3180-1 libarchive -- security update
Alexander Cherepanov discovered that bsdcpio, an implementation of the cpio program part of the libarchive project, is susceptible to a directory traversal vulnerability via absolute paths For the stable distribution (wheezy), this problem has been fixed in version 304-3+wheezy1 For the upcoming stable distribution (jessie), this problem has be ...
Red Hat: CVE-2015-2304
Absolute path traversal vulnerability in bsdcpio in libarchive 312 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive ...

References

CWE-22http://www.openwall.com/lists/oss-security/2015/01/07/5https://github.com/libarchive/libarchive/pull/110https://github.com/libarchive/libarchive/commit/59357157706d47c365b2227739e17daba3607526http://www.debian.org/security/2015/dsa-3180http://www.openwall.com/lists/oss-security/2015/01/16/7http://lists.opensuse.org/opensuse-updates/2015-03/msg00065.htmlhttp://www.ubuntu.com/usn/USN-2549-1http://advisories.mageia.org/MGASA-2015-0106.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2015:157https://www.freebsd.org/security/advisories/FreeBSD-SA-16:22.libarchive.aschttp://www.securitytracker.com/id/1035996https://security.gentoo.org/glsa/201701-03https://groups.google.com/forum/#%21msg/libarchive-discuss/dN9y1VvE1Qk/Z9uerigjQn0Jhttps://usn.ubuntu.com/2549-1/https://nvd.nist.govhttps://access.redhat.com/security/cve/cve-2015-2304
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27977IMAPlocal usersCVE-2024-32038CVE-2023-49963CVE-2023-22869CVE-2024-31497localCVE-2024-2961
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook