CVE-2015-0552

2015-01-1515:59:26

CWE-22

debian

web.nvd.nist.gov

cve-2015-0552

directory traversal

vulnerability

remote attackers

arbitrary files

libgcab

gcab 0.4

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

AI Score

6.7

Confidence

Low

EPSS

0.008

Percentile

81.1%

JSON

Directory traversal vulnerability in the gcab_folder_extract function in libgcab/gcab-folder.c in gcab 0.4 allows remote attackers to write to arbitrary files via crafted path in a CAB file, as demonstrated by “\tmp\moo.”

Affected configurations

Nvd

Node

gnomegcabMatch0.4

Node

opensuseopensuseMatch13.1

opensuseopensuseMatch13.2

VendorProductVersionCPE
gnomegcab0.4cpe:2.3:a:gnome:gcab:0.4:*:*:*:*:*:*:*
opensuseopensuse13.1cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
opensuseopensuse13.2cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gnome	gcab	0.4	cpe:2.3:a:gnome:gcab:0.4:::::::*
opensuse	opensuse	13.1	cpe:2.3:o:opensuse:opensuse:13.1:::::::*
opensuse	opensuse	13.2	cpe:2.3:o:opensuse:opensuse:13.2:::::::*