CVE-2015-0480
Public on 2015-04-16
Modified on 2015-05-05
Description
A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted.
Severity
Low
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 1 | java-1.6.0-openjdk | 2015-04-23 | ALAS-2015-515 | Fixed |
| Amazon Linux 1 | java-1.7.0-openjdk | 2015-04-23 | ALAS-2015-516 | Fixed |
| Amazon Linux 1 | java-1.8.0-openjdk | 2015-05-05 | ALAS-2015-517 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv2 | 2.6 | AV:N/AC:H/Au:N/C:N/I:P/A:N |
| NVD | CVSSv2 | 5.8 | AV:N/AC:M/Au:N/C:N/I:P/A:P |