CVE-2015-2304: Canonical Ubuntu Linux

Medium severity, CVSS 6.4. EPSS: 4.9% chance of exploitation in the next 30 days.

Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 14.10 only
• Libarchive Libarchive: up to and including 3.1.2
• Opensuse Opensuse: version 13.1 only; version 13.2 only

Published 2015-03-15. Last modified 2026-06-17.