Vulnerability Details : CVE-2015-1038

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.

Published 2015-01-21 18:59:52

Updated 2017-09-08 01:29:47

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2015-1038

Probability of exploitation activity in the next 30 days: 2.45%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 89 % EPSS Score History EPSS FAQ

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
5.8	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:P	8.6	4.9	[email protected]
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Assigned by: [email protected] (Primary)

Oracle » Solaris » Version: 11.2
cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*
Matching versions
Oracle » Solaris » Version: 10.0
cpe:2.3:o:oracle:solaris:10.0:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 22
cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 23
cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
Matching versions
7-zip » P7zip » Version: 9.20.1
cpe:2.3:a:7-zip:p7zip:9.20.1:*:*:*:*:*:*:*
Matching versions