CVE:CVE-2015-2304
CNNVD:CNNVD-201503-334
libarchive是一个多格式存档和压缩库。
libarchive 3.1.2及之前版本的bsdcpio工具包中存在绝对路径遍历漏洞。远程攻击者可借助存档文件的完整路径名利用该漏洞写入任意文件。
solution:Upgrade libarchive libarchive to a higher version than 3.1.2,and avoid the version (,3.1.2]; Upgrade canonical ubuntu_linux to a higher version than 12.04,14.04,14.10,and avoid the version 12.04,14.04,14.10; Upgrade opensuse opensuse to a higher version than 13.1,13.2,and avoid the version 13.1,13.2