CVE-2015-0557 Information

Description

Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.

Reference

http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html http://www.debian.org/security/2015/dsa-3213 http://www.mandriva.com/security/advisories?name=MDVSA-2015:201 http://www.openwall.com/lists/oss-security/2015/01/03/5 http://www.openwall.com/lists/oss-security/2015/01/05/9 http://www.securityfocus.com/bid/71895 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774435 https://security.gentoo.org/glsa/201612-15