CVE-2015-1191
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to...
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
Exploit likelihood
What each source reports
NVD Score used
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
- Record
CVE-2015-1191- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
- Record
CVE-2015-1191- Updated
- 2026-11-02
EUVDEUVD-2015-1333 No score
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
- Record
EUVD-2015-1333- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7cfm-r6gg-c84j No score
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to...
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
- Record
GHSA-7cfm-r6gg-c84j- Weakness
- CWE-22
- Updated
- 2026-11-02
OSV No score
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
- Record
CVE-2015-1191- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-1191 No score
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
- Record
DEBIAN-CVE-2015-1191- Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2016-0104 No score
Updated pigz packages fix security vulnerability
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a full pathname or .. (dot dot) in an archive (CVE-2015-1191).
- Record
MGASA-2016-0104- Updated
- 2026-11-02
OSVSUSE-SU-2015:0670-1 No score
Security update for pigz
Pigz, a multi-threaded implementation of gzip, was updated to fix one vulnerability.
The following vulnerability was fixed:
- A crafted file could have caused an unwanted directory traversal on extract (CVE-2015-1191)
- Record
SUSE-SU-2015:0670-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0716-1 No score
Security update for pigz
This pigz update to version 2.1.6 includes a security fix and several bug fixes:
* fix temporary file permission bug (bnc#803933, CVE-2013-0296)
* fix dictzip with #CPU == 1 (bnc#597756)
Security Issue reference:
* CVE-2013-0296
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0296>
- Record
SUSE-SU-2015:0716-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-1191 No score
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
- Record
UBUNTU-CVE-2015-1191- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pigzDebian:12 |
before 2.3.1-2 | 2.3.1-2 |
pigzDebian:13 |
before 2.3.1-2 | 2.3.1-2 |
pigzDebian:14 |
before 2.3.1-2 | 2.3.1-2 |
pigzMageia:5 |
before 2.3.1-3.1.mga5 | 2.3.1-3.1.mga5 |
pigzSUSE:Linux Enterprise Desktop 12 |
before 2.3-5.1 | 2.3-5.1 |
pigzSUSE:Linux Enterprise Server 12 |
before 2.3-5.1 | 2.3-5.1 |
pigzSUSE:Linux Enterprise Server for SAP Applications 12 |
before 2.3-5.1 | 2.3-5.1 |
pigzUbuntu:Pro:14.04:LTS |
before 2.3-2ubuntu0.1~esm1, plus listed versions 2.2.4-32.3-2 |
2.3-2ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1191 is a medium vulnerability (CVSS 5.0) in Zlib Pigz, published June 10, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.03%, the 87th percentile. Fixed in pigz 2.3.1-2.
References
lists.opensuse.org/opensuse-updates/2016-03/msg00017.html
github.com/madler/pigz/commit/fdad1406b3ec809f4954ff7cdf9e99eb18c2458f
openwall.com/lists/oss-security/2015/01/18/3
securityfocus.com/bid/72109
bugs.debian.org/cgi-bin/bugreport.cgi?bug=774978
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-1191
security-tracker.debian.org/tracker/CVE-2015-1191
advisories.mageia.org/MGASA-2016-0104.html
bugs.mageia.org/show_bug.cgi?id=17895
suse.com/support/update/announcement/2015/suse-su-20150670-1
bugzilla.suse.com/913627
ubuntu.com/security/CVE-2015-1191
cve.org/CVERecord?id=CVE-2015-1191