10

CVE-2004-0771

Buffer overflow in the extract_one function from lhext.c in LHA may allow attackers to execute arbitrary code via a long w (working directory) command line option, a different issue than CVE-2004-0769. NOTE: this issue may be REJECTED if there are not any cases in which LHA is setuid or is otherwise used across security boundaries.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tsugio Okamoto ≫ Lha Version1.14
Tsugio Okamoto ≫ Lha Version1.15
Tsugio Okamoto ≫ Lha Version1.17
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 18.83% 0.969
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://bugzilla.fedora.us/show_bug.cgi?id=1833
http://bugs.gentoo.org/show_bug.cgi?id=51285
http://www.gentoo.org/security/en/glsa/glsa-200409-13.xml
http://www.redhat.com/support/errata/RHSA-2004-323.html
http://www.redhat.com/support/errata/RHSA-2004-440.html
http://marc.info/?l=bugtraq&m=108668791510153
http://www.securityfocus.com/archive/1/363418
http://www.securityfocus.com/bid/10354
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16196
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9595