Published: 23/11/2004 Updated: 11/10/2017

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Buffer overflow in the extract_one function from lhext.c in LHA may allow malicious users to execute arbitrary code via a long w (working directory) command line option, a different issue than CVE-2004-0769. NOTE: this issue may be REJECTED if there are not any cases in which LHA is setuid or is otherwise used across security boundaries.

Vulnerable Product	Search on Vulmon	Subscribe to Product
tsugio okamoto lha 1.14
tsugio okamoto lha 1.15
tsugio okamoto lha 1.17

Synopsis lha security update Type/Severity Security Advisory: Important Topic An updated lha package that fixes a buffer overflow is now available Description LHA is an archiving and compression utility for LHarc format archivesLukasz Wojtow discovered a stack-based buffer overflow in all ...

//source: wwwsecurityfocuscom/bid/10354/info // //LHA has been reported prone to multiple vulnerabilities that may allow a malicious archive to execute arbitrary code or corrupt arbitrary files when the archive is operated on These issues are triggered in the 'extract_one()' and are due to a failure of the application to properly validate ...

NVD-CWE-Other http://www.securityfocus.com/bid/10354 http://www.securityfocus.com/archive/1/363418 http://bugs.gentoo.org/show_bug.cgi?id=51285 https://bugzilla.fedora.us/show_bug.cgi?id=1833 http://www.gentoo.org/security/en/glsa/glsa-200409-13.xml http://www.redhat.com/support/errata/RHSA-2004-440.html http://www.redhat.com/support/errata/RHSA-2004-323.html http://marc.info/?l=bugtraq&m=108668791510153 https://exchange.xforce.ibmcloud.com/vulnerabilities/16196 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9595 https://access.redhat.com/errata/RHSA-2004:323 https://nvd.nist.gov https://www.exploit-db.com/exploits/24120/

CVE-2004-0771

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect