CVE-2015-0480: Medium severity oracle java se 7 vulnerability
A directory traversal flaw was found in jar, The Java Archive Tool. Relative paths containing '..' or absolute paths used for files stored in a specially-crafted jar archive could cause the jar tool to overwrite arbitrary files when the archive was extracted.
With this update, jar strips leading '/' or path prefix that contains '..'. New command line option -P can be used to revert back to the old insecure behavior which preserves absolute paths and paths with '..'.
This issue was reported multiple times in the past and already got CVE-2005-1080 (bug 606442) assigned. This CVE is a duplicate of the old 2005 id.
Other sources
Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0480?
CVE-2015-0480 affects the integrity and availability of Oracle Java SE components.
How do I fix CVE-2015-0480?
To fix CVE-2015-0480, update Oracle Java SE to the latest version or apply the recommended patches for IcedTea and JDK.
Which versions of Oracle Java SE are affected by CVE-2015-0480?
CVE-2015-0480 impacts Oracle Java SE versions 5.0u81, 6u91, 7u76, and 8u40.
Is there a directory traversal vulnerability in CVE-2015-0480?
Yes, CVE-2015-0480 includes a directory traversal flaw found in the Java Archive Tool.
What tools are implicated in CVE-2015-0480?
The Java Archive Tool (jar) is specifically mentioned in relation to the vulnerability in CVE-2015-0480.