{"api_version":"1","generated_at":"2026-07-23T09:17:37+00:00","cve":"CVE-2015-0557","urls":{"html":"https://cve.report/CVE-2015-0557","api":"https://cve.report/api/cve/CVE-2015-0557.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-0557","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-0557"},"summary":{"title":"CVE-2015-0557","description":"Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.","state":"PUBLISHED","assigner":"debian","published_at":"2015-04-08 18:59:04","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-22","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5.8","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html","name":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[SECURITY] Fedora 20 Update: arj-3.10.22-22.fc20","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2015/dsa-3213","name":"http://www.debian.org/security/2015/dsa-3213","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Debian -- Security Information -- DSA-3213-1 arj","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:201","name":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:201","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Support / Security / Advisories /  / MDVSA-2015:201 | Mandriva","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774435","name":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774435","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"#774435 - arj: CVE-2015-0557: directory traversal via //multiple/leading/slash - Debian Bug report logs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.gentoo.org/glsa/201612-15","name":"https://security.gentoo.org/glsa/201612-15","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"ARJ: Multiple vulnerabilities (GLSA 201612-15) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/71895","name":"http://www.securityfocus.com/bid/71895","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"ARJ CVE-2015-0557 Directory Traversal Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html","name":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[SECURITY] Fedora 22 Update: arj-3.10.22-22.fc22","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2015/01/03/5","name":"http://www.openwall.com/lists/oss-security/2015/01/03/5","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - CVE Request: arj: symlink directory traversal and directory\n traversal via //multiple/leading/slash","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html","name":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[SECURITY] Fedora 21 Update: arj-3.10.22-22.fc21","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2015/01/05/9","name":"http://www.openwall.com/lists/oss-security/2015/01/05/9","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - Re: CVE Request: arj: symlink directory traversal and directory\n traversal via //multiple/leading/slash","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-0557","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0557","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"557","vulnerable":"1","versionEndIncluding":"3.10.22","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"arj_software","cpe5":"arj_archiver","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"557","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"20","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"557","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"21","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"557","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"22","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T04:10:11.059Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"MDVSA-2015:201","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:201"},{"name":"FEDORA-2015-5546","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html"},{"name":"[oss-security] 20150105 Re: CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2015/01/05/9"},{"name":"GLSA-201612-15","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"],"url":"https://security.gentoo.org/glsa/201612-15"},{"name":"[oss-security] 20150103 CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2015/01/03/5"},{"name":"FEDORA-2015-5524","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html"},{"name":"DSA-3213","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2015/dsa-3213"},{"name":"FEDORA-2015-5603","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html"},{"name":"71895","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/71895"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774435"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-01-02T00:00:00.000Z","descriptions":[{"lang":"en","value":"Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-06-30T16:57:01.000Z","orgId":"79363d38-fa19-49d1-9214-5f28da3f3ac5","shortName":"debian"},"references":[{"name":"MDVSA-2015:201","tags":["vendor-advisory","x_refsource_MANDRIVA"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:201"},{"name":"FEDORA-2015-5546","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html"},{"name":"[oss-security] 20150105 Re: CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2015/01/05/9"},{"name":"GLSA-201612-15","tags":["vendor-advisory","x_refsource_GENTOO"],"url":"https://security.gentoo.org/glsa/201612-15"},{"name":"[oss-security] 20150103 CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2015/01/03/5"},{"name":"FEDORA-2015-5524","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html"},{"name":"DSA-3213","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2015/dsa-3213"},{"name":"FEDORA-2015-5603","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html"},{"name":"71895","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/71895"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774435"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@debian.org","ID":"CVE-2015-0557","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"MDVSA-2015:201","refsource":"MANDRIVA","url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:201"},{"name":"FEDORA-2015-5546","refsource":"FEDORA","url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html"},{"name":"[oss-security] 20150105 Re: CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2015/01/05/9"},{"name":"GLSA-201612-15","refsource":"GENTOO","url":"https://security.gentoo.org/glsa/201612-15"},{"name":"[oss-security] 20150103 CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2015/01/03/5"},{"name":"FEDORA-2015-5524","refsource":"FEDORA","url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html"},{"name":"DSA-3213","refsource":"DEBIAN","url":"http://www.debian.org/security/2015/dsa-3213"},{"name":"FEDORA-2015-5603","refsource":"FEDORA","url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html"},{"name":"71895","refsource":"BID","url":"http://www.securityfocus.com/bid/71895"},{"name":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774435","refsource":"CONFIRM","url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774435"}]}}}},"cveMetadata":{"assignerOrgId":"79363d38-fa19-49d1-9214-5f28da3f3ac5","assignerShortName":"debian","cveId":"CVE-2015-0557","datePublished":"2015-04-08T18:00:00.000Z","dateReserved":"2015-01-05T00:00:00.000Z","dateUpdated":"2024-08-06T04:10:11.059Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-04-08 18:59:04","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-22","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:arj_software:arj_archiver:*:*:*:*:*:*:*:*","versionEndIncluding":"3.10.22","matchCriteriaId":"10FB609E-F842-4F2B-BD6E-9D6CD1968E82"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*","matchCriteriaId":"FF47C9F0-D8DA-4B55-89EB-9B2C9383ADB9"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*","matchCriteriaId":"56BDB5A0-0839-4A20-A003-B8CD56F48171"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*","matchCriteriaId":"253C303A-E577-4488-93E6-68A8DD942C38"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"557","Ordinal":"1","Title":"CVE-2015-0557","CVE":"CVE-2015-0557","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"557","Ordinal":"1","NoteData":"Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.","Type":"Description","Title":"CVE-2015-0557"},{"CveYear":"2015","CveId":"557","Ordinal":"2","NoteData":"2015-04-08","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"557","Ordinal":"3","NoteData":"2017-06-30","Type":"Other","Title":"Modified"}]}}}