Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.mandriva.com/security/advisories?name=MDVSA-2015:201 | vendor-advisory x_refsource_MANDRIVA |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html | vendor-advisory x_refsource_FEDORA |
| http://www.openwall.com/lists/oss-security/2015/01/05/9 | mailing-list x_refsource_MLIST |
| https://security.gentoo.org/glsa/201612-15 | vendor-advisory x_refsource_GENTOO |
| http://www.openwall.com/lists/oss-security/2015/01/03/5 | mailing-list x_refsource_MLIST |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html | vendor-advisory x_refsource_FEDORA |
| http://www.debian.org/security/2015/dsa-3213 | vendor-advisory x_refsource_DEBIAN |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html | vendor-advisory x_refsource_FEDORA |
| http://www.securityfocus.com/bid/71895 | vdb-entry x_refsource_BID |
| https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774435 | x_refsource_CONFIRM |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|