Path Traversal in GNOME Gcab
CVE-2015-0552
Directory traversal vulnerability in the gcab_folder_extract function in libgcab/gcab-folder.c in gcab 0.4 allows remote attackers to write to arbitrary files via crafted path in a CAB file, as demonstrated by "\tmp\moo."
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.028 (84.9th percentile) — read the EPSS interpretation.
Affected products
- Gnome Gcab — versions 0.4
- Opensuse — versions 13.1, 13.2
- N/a — versions n/a
Weakness classification (CWE)
References
- security@debian.org (x_refsource_CONFIRM, Exploit)
- security@debian.org (x_refsource_SECUNIA, third-party-advisory)
- security@debian.org (x_refsource_CONFIRM)
- security@debian.org (mailing-list, x_refsource_MLIST)
- security@debian.org (vendor-advisory, x_refsource_SUSE)