CVE-2015-1038: Medium severity red hat fedora vulnerability
It was reported [1] that p7zip suffers from a directory traversal flaw. This could for the overwriting of arbitrary files through uncompressing a crafted archive, with the privileges of the user running 7z. For example:
$ ln -s /tmp foo $ 7z a test.7z foo $ rm foo $ mkdir foo $ echo hello > foo/test $ 7z a test.7z foo/test $ rm -rf foo $ 7z x test.7z
This will create 'foo' as a symlink to /tmp which will in turn contain the file 'test' with the privileges of the user unarchiving 'test.7z'.
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660
Other sources
p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1038?
CVE-2015-1038 has a medium severity rating due to its potential for directory traversal flaws that could lead to file overwriting.
How do I fix CVE-2015-1038?
To fix CVE-2015-1038, upgrade the p7zip package to versions higher than 9.20.1~dfsg.1-4 or apply relevant security patches.
Which versions of p7zip are affected by CVE-2015-1038?
CVE-2015-1038 affects p7zip versions up to and including 9.20.1~dfsg.1-4.
What platforms are impacted by CVE-2015-1038?
CVE-2015-1038 impacts multiple platforms including Debian, Fedora, and Oracle Solaris.
Can I exploit CVE-2015-1038 remotely?
CVE-2015-1038 is not considered a remote exploit, as it requires user interaction to uncompress a crafted archive.