CVE-2015-1038: 7-zip p7zip Link Following

CVSS: 5.8v2.0MediumModified

AliasesMGASA-2015-0252SUSE-SU-2015:1433-1UBUNTU-CVE-2015-1038+3 more

Published 21-01-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-1038 is a medium (CVSS 5.8) Link Following vulnerability in 7-zip p7zip. EPSS estimates a 3.29% chance of exploitation in the next 30 days, higher than 88.4% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

34/100

0100

Medium · default modelHow is this calculated?

CVSS score

5.8/10

010

Medium · v2.0 (NVD)

EPSS score

3.29%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2024:10322-1

Timeline

21-01-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.

CVSS metrics

1 score · 1 source · 1 version

v2.05.8

EPSS trend

Probability

3.29%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

0.00 pp

From 3.29% on 21-09-2026

21-09-202621-10-2026

EPSS score

3.29%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (bugs.debian.org)
Maturity: unknown
referenceUnverified
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected systems

Suse3 products

p7zip&distro=SUSE Linux Enterprise Desktop 12< 9.20.1-3.2
p7zip&distro=SUSE Linux Enterprise Server 12< 9.20.1-3.2
p7zip&distro=SUSE Linux Enterprise Server for SAP Applications 12< 9.20.1-3.2

Mageia2 products

p7zip< 9.20.1-4.1.mga4
p7zip< 9.20.1-6.1.mga5

7-zip1 product

p7zip9.20.1

Debian1 product

p7zip< 9.20.1~dfsg.1-4.2 | < 9.04~dfsg.1-1+deb6u1 | < 9.20.1~dfsg.1-4+deb7u1 | < 9.20.1~dfsg.1-4.1+deb8u1

Fedoraproject1 product

fedoraEOL22 | 23

Oracle1 product

solarisEOL10.0 | 11.2

Ubuntu1 product

p7zip< 9.20.1~dfsg.1-4+deb7u1build0.14.04.1

7 vendors · 10 products

References

19 links

lists.opensuse.org/opensuse-updates/2015-07/msg00000.htmlVendor AdvisoryX Refsource SUSE
bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660X Refsource MISCExploitThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-December/174245.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=1179505X Refsource MISCExploitIssue Tracking
www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlX Refsource CONFIRMThird Party Advisory
www.securityfocus.com/bid/71890VDB EntryX Refsource BIDThird Party Advisory
www.debian.org/security/2015/dsa-3289Vendor AdvisoryX Refsource DEBIAN
www.openwall.com/lists/oss-security/2015/01/11/2Mailing ListX Refsource MLISTThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-December/173245.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/99970VDB EntryX Refsource XF

Show all 19 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities