CVE-2015-2060 cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character t...
MediumCVSS 5.3
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/cabextract(Debian:12) | < 1.6-1 | 1.6-1 |
| debian/cabextract(Debian:13) | < 1.6-1 | 1.6-1 |
| debian/cabextract(Debian:14) | < 1.6-1 | 1.6-1 |
| cabextract project cabextract | < 1.6 | 1.6 |
References
- Debian Security Tracker CVE-2015-2060 vendor-advisory
- lists.fedoraproject.org issue-tracking patch third-party-advisory
- lists.fedoraproject.org issue-tracking patch third-party-advisory
- www.cabextract.org.uk vendor-advisory
- www.mandriva.com broken-link
- www.openwall.com exploit mailing-list third-party-advisory
- www.openwall.com mailing-list mitigation third-party-advisory
- www.openwall.com mailing-list mitigation third-party-advisory
- bugs.debian.org issue-tracking