CVE-2015-0552: Path Traversal
Published Jan 4, 2015
·Updated
Directory traversal vulnerability in the gcabfolderextract function in libgcab/gcab-folder.c in gcab 0.4 allows remote attackers to write to arbitrary files via crafted path in a CAB file, as demonstrated by "\tmp\moo."
Affected Software
4 affected componentsFixes available
debian/gcab
1.4-31.5-11.6-1
Gnome gcab=0.4
openSUSE openSUSE=13.1
openSUSE openSUSE=13.2
Event History
Jan 4, 2015
Data Sourced
05:15 PM
SeverityAffected Software
Jan 15, 2015
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-0552?
CVE-2015-0552 is a medium severity vulnerability that allows remote attackers to exploit a directory traversal issue.
2
How do I fix CVE-2015-0552?
To fix CVE-2015-0552, upgrade gcab to version 1.4-3, 1.5-1, or 1.6-1.
3
Which versions of gcab are affected by CVE-2015-0552?
CVE-2015-0552 affects gcab version 0.4.
4
What is a directory traversal vulnerability in CVE-2015-0552?
A directory traversal vulnerability allows attackers to write to arbitrary files on the server via crafted paths.
5
Which distributions are affected by CVE-2015-0552?
CVE-2015-0552 affects Debian and openSUSE distributions containing vulnerable versions of gcab.