CVE-2015-8564

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal sequences in the XML install file in an extension package archive.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-20 CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://developer.joomla.org/security-centre/634-20151214-core-directory-traversal.htmlVendor Advisory
https://developer.joomla.org/security-centre/634-20151214-core-directory-traversal.htmlVendor Advisory

Timeline

Published: Dec 16, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-85657.5Directory traversal vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to have unspecified impact v CVE-2015-85667.5The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.CVE-2015-85677.7Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).CVE-2015-85686.5Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of servic CVE-2015-85692.3The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length CVE-2015-85707.4The password reset functionality in Lepide Active Directory Self Service allows remote authenticated users to change arbitrary domain user p CVE-2015-85716.8Integer overflow in Autodesk Design Review (ADR) before 2013 Hotfix 2 allows remote attackers to execute arbitrary code via a crafted biClrU CVE-2015-85726.8Multiple buffer overflows in Autodesk Design Review (ADR) before 2013 Hotfix 2 allow remote attackers to execute arbitrary code via crafted CVE-2015-85754.0The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an address length, which allows local use CVE-2015-85772.6The Buffer Overflow Protection (BOP) feature in McAfee VirusScan Enterprise before 8.8 Patch 6 allocates memory with Read, Write, Execute (R CVE-2015-85786.4AVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode p CVE-2015-85796.4Kaspersky Total Security 2015 15.0.2.361 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecti