PT-2015-4712 · Gnome+1 · Gcab+1

Stephen Kitt · Published 2015-01-09 · Updated 2018-10-30 · CVE-2015-0552

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions gcab version 0.4

Description A directory traversal issue exists in the gcab folder extract function, allowing remote attackers to write to arbitrary files via a crafted path in a CAB file. This can be achieved by using a specially crafted path, such as "tmpmoo".

Recommendations For gcab version 0.4, consider restricting access to the gcab folder extract function until a patch is available, or avoid using this function with untrusted CAB files to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2015-1282

CVE-2015-0552

MGASA-2015-0018

OPENSUSE-SU-2024:10254-1

Affected Products

Alt Linux

Gcab

References · 15

• 🔥 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774580 · Exploit
• http://lists.opensuse.org/opensuse-updates/2015-01/msg00018.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0552 · Security Note
• https://advisories.mageia.org/MGASA-2015-0018.html · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0018 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-0552 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-0552 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-0552 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0552 · Security Note
• https://errata.altlinux.org/ALT-PU-2015-1282 · Vendor Advisory
• http://openwall.com/lists/oss-security/2015/01/05/7 · Note
• https://bugs.mageia.org/show_bug.cgi?id=14962 · Note
• http://secunia.com/advisories/62310 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2015-0552 · Note
• https://bugzilla.gnome.org/show_bug.cgi?id=742331 · Note