Bug 552646 (CVE-2015-2304)

Summary:	<app-arch/libarchive-3.1.2-r1: Path traversal vulnerability (CVE-2015-2304)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	bsd+disabled, ssuominen
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	A4 [glsa cve]
Package list:		Runtime testing required:	---
Bug Depends on:	586182
Bug Blocks:

Description GLSAMaker/CVETool Bot gentoo-dev

2015-06-20 15:06:47 UTC

CVE-2015-2304 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2304):
  Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and
  earlier allows remote attackers to write to arbitrary files via a full
  pathname in an archive.

Comment 1 Aaron Bauman (RETIRED) gentoo-dev

2016-06-27 12:48:57 UTC

Added to existing GLSA request.

Comment 2 GLSAMaker/CVETool Bot gentoo-dev

2017-01-01 14:34:20 UTC

This issue was resolved and addressed in
 GLSA 201701-03 at https://security.gentoo.org/glsa/201701-03
by GLSA coordinator Thomas Deutschmann (whissi).