{"id":"CVE-2015-0557","aliases":["DEBIAN-CVE-2015-0557","DLA-188-1","DSA-3213-1","EUVD-2015-0570","GHSA-8773-c847-4382","MGASA-2015-0150"],"status":"published","title":"Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which...","description":"Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03343,"percentile":0.88744,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2015-04-06T00:00:00Z","modified":"2026-09-09T06:47:24Z","fixes":[{"ecosystem":"Debian:12","package":"arj","fixed_in":["3.10.22-13"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"arj","fixed_in":["3.10.22-13"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"arj","fixed_in":["3.10.22-13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"arj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-13"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"arj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-13"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"arj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-13"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"arj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-9+deb6u1"}]}],"versions":["3.10.22-9"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"arj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-10+deb7u1"}]}],"versions":["3.10.22-10"],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"arj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-9.mga4"}]}],"bundled":3}],"products":[{"vendor":"arj_software","product":"arj_archiver"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:201","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/01/05/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201612-15","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/01/03/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3213","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/71895","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774435","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0557"},{"url":"https://github.com/advisories/GHSA-8773-c847-4382"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-0557","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0150.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15586","tags":["report"]},{"url":"https://www.debian.org/security/2015/dsa-3213","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-0557","description":"Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.","status":"published","published":"2015-04-08T18:00:00Z","modified":"2024-08-06T04:10:11.059Z","updated_at":"2026-11-02T14:35:45.763329Z"}],"euvd":[{"id":"EUVD-2015-0570","description":"Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.","status":"published","published":"2015-04-08T18:00:00Z","modified":"2024-08-06T04:10:11Z","updated_at":"2026-11-03T02:22:18.860994Z"}],"ghsa":[{"id":"GHSA-8773-c847-4382","title":"Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which...","description":"Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.","status":"published","published":"2022-05-17T02:38:52Z","modified":"2023-01-27T05:05:35Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:42:43.440689Z"}],"nvd":[{"id":"CVE-2015-0557","description":"Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.","status":"published","published":"2015-04-08T18:59:04.89Z","modified":"2026-06-17T00:20:31.333Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:03:04.095849Z"}],"osv":[{"id":"CVE-2015-0557","description":"Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.","status":"published","published":"2015-04-08T18:59:04Z","modified":"2026-04-16T06:25:54.865295615Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2015-0557","description":"Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.","status":"published","published":"2015-04-08T18:59:04.89Z","modified":"2026-09-09T06:47:24.952803451Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DLA-188-1","title":"arj - security update","status":"published","published":"2015-04-08T00:00:00Z","modified":"2026-03-09T01:18:46.951886Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-3213-1","title":"arj - security update","status":"published","published":"2015-04-06T00:00:00Z","modified":"2026-03-09T01:20:39.95303Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0150","title":"Updated arj packages fix security vulnerabilities","description":"Updated arj package fixes security vulnerabilities:\n\nARJ follows symlinks when unpacking stuff, even the symlinks that were created\nduring the same unpack process, making it vulnerable to a directory traversal\n(CVE-2015-0556).\n\nTo protect from directory traversals, ARJ strips leading slash from the path\nwhen unpacking, but this protection can be easily bypassed by adding more than\none leading slash to the path (CVE-2015-0557).\n\nARJ is vulnerable to a buffer overflow when processing a specially crafted arj\nfile (CVE-2015-2782).\n","status":"published","published":"2015-04-15T09:01:28Z","modified":"2026-04-16T06:26:25.654797952Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}