CVE-2015-0556
Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks...
Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.
Exploit likelihood
What each source reports
NVD Score used
Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.
- Record
CVE-2015-0556- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.
- Record
CVE-2015-0556- Updated
- 2026-11-02
EUVDEUVD-2015-0569 No score
Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.
- Record
EUVD-2015-0569- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pxmh-fjvc-v752 No score
Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks...
Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.
- Record
GHSA-pxmh-fjvc-v752- Weakness
- CWE-59
- Updated
- 2026-11-02
OSV No score
Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.
- Record
CVE-2015-0556- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-0556 No score
Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.
- Record
DEBIAN-CVE-2015-0556- Updated
- 2026-11-02
OSVMGASA-2015-0150 No score
Updated arj packages fix security vulnerabilities
Updated arj package fixes security vulnerabilities:
ARJ follows symlinks when unpacking stuff, even the symlinks that were created during the same unpack process, making it vulnerable to a directory traversal (CVE-2015-0556).
To protect from directory traversals, ARJ strips leading slash from the path when unpacking, but this protection can be easily bypassed by adding more than one leading slash to the path (CVE-2015-0557).
ARJ is vulnerable to a buffer overflow when processing a specially crafted arj file (CVE-2015-2782).
- Record
MGASA-2015-0150- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
arjDebian:12 |
before 3.10.22-13 | 3.10.22-13 |
arjDebian:13 |
before 3.10.22-13 | 3.10.22-13 |
arjDebian:14 |
before 3.10.22-13 | 3.10.22-13 |
arjDebian:6.0 From an advisory covering 3 CVEs |
before 3.10.22-9+deb6u1, plus listed versions 3.10.22-9 |
3.10.22-9+deb6u1 |
arjDebian:7 From an advisory covering 3 CVEs |
before 3.10.22-10+deb7u1, plus listed versions 3.10.22-10 |
3.10.22-10+deb7u1 |
arjMageia:4 From an advisory covering 3 CVEs |
before 3.10.22-9.mga4 | 3.10.22-9.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0556 is a medium vulnerability (CVSS 5.8) in Arj Software Archiver, published April 6, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.81%, the 90th percentile. Fixed in arj 3.10.22-13.
References
mandriva.com/security/advisories?name=MDVSA-2015:201
lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html
openwall.com/lists/oss-security/2015/01/05/9
security.gentoo.org/glsa/201612-15
Show 9 moreShow less
securityfocus.com/bid/71860
debian.org/security/2015/dsa-3213
bugs.debian.org/cgi-bin/bugreport.cgi?bug=774434
nvd.nist.gov/vuln/detail/CVE-2015-0556
github.com/advisories/GHSA-pxmh-fjvc-v752
security-tracker.debian.org/tracker/CVE-2015-0556
advisories.mageia.org/MGASA-2015-0150.html
bugs.mageia.org/show_bug.cgi?id=15586