Unrated severityNVD Advisory· Published Apr 8, 2015· Updated May 6, 2026
CVE-2015-0557
CVE-2015-0557
Description
Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.
Affected products
4cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
10- bugs.debian.org/cgi-bin/bugreport.cginvdExploit
- lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.htmlnvd
- lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.htmlnvd
- lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.htmlnvd
- www.debian.org/security/2015/dsa-3213nvd
- www.mandriva.com/security/advisoriesnvd
- www.openwall.com/lists/oss-security/2015/01/03/5nvd
- www.openwall.com/lists/oss-security/2015/01/05/9nvd
- www.securityfocus.com/bid/71895nvd
- security.gentoo.org/glsa/201612-15nvd
News mentions
0No linked articles in our index yet.