CVE-2015-2060

Description

cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash.

Weakness classification

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references

• cve@mitre.org — Issue Tracking, Patch, Third Party Advisory
• cve@mitre.org — Issue Tracking, Patch, Third Party Advisory
• cve@mitre.org — Vendor Advisory
• cve@mitre.org — Broken Link
• cve@mitre.org — Exploit, Mailing List, Third Party Advisory
• cve@mitre.org — Mailing List, Mitigation, Third Party Advisory
• cve@mitre.org — Mailing List, Mitigation, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Broken Link
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mailing List, Third Party Advisory