p PatchFirst

CVE-2015-2060

CVE-2015-2060

This page contains facts from public vulnerability sources. Check the original advisory before updating.

cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash.

CVSS 5.3 · Medium · EPSS 2.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • cabextract Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.6-1

    Update to 1.6-1

  • cabextract Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.6-1

    Update to 1.6-1

  • cabextract Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.6-1

    Update to 1.6-1

  • cabextract Ubuntu:Pro:14.04:LTS

    Versions
    • 1.4-4
    Affected ranges
    • ECOSYSTEM: < 1.4-4ubuntu0.1~esm1

    Update to 1.4-4ubuntu0.1~esm1

Original sources

Check your server →