Unscored CVE-2015-1589 EUVD-2015-1720GHSA-pmjm-c5h8-vf2q

Directory traversal vulnerability in arCHMage 0.2.4 allows remote attackers to write to arbitrary files via a .. (dot dot) in a CHM file.

Published Feb 23, 2015 · Updated Aug 6, 2024 · Assigned by mitre

Package: archmage Package: archmage Ecosystem: Debian Ecosystem: Ubuntu

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	archmage	1:0.2.4-4	—
Debian 13	archmage	1:0.2.4-4	—
Debian 12	archmage	1:0.2.4-4	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 14.04 LTS	archmage	1:0.2.4-4build0.14.04.1	—

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776164
[oss-security] 20150212 CVE request: archmage directory traversal mailing-list
archmage-cve20151589-dir-trav(100879) vdb-entry
[oss-security] 20150212 Re: CVE request: archmage directory traversal mailing-list