CVE-2002-0370 Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames, includi...
HighCVSS 7.5
EPSS 43.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames, including (1) Microsoft Windows 98 with Plus! Pack, (2) Windows XP, (3) Windows ME, (4) Lotus Notes R4 through R6 (pre-gold), (5) Verity KeyView, and (6) Stuffit Expander before 7.0.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| allume systems division stuffit expander | = 6.5.2 | No fix listed |
| ibm lotus notes | <= 4.5 | No fix listed |
| ibm lotus notes | = 5.0 | No fix listed |
| ibm lotus notes | = 5.0.1 | No fix listed |
| ibm lotus notes | = 5.0.2 | No fix listed |
| ibm lotus notes | = 5.0.3 | No fix listed |
| ibm lotus notes | = 5.0.4 | No fix listed |
| ibm lotus notes | = 5.0.5 | No fix listed |
| ibm lotus notes | = 5.0.9a | No fix listed |
| ibm lotus notes | = 5.0.10 | No fix listed |
| ibm lotus notes | = 5.0.11 | No fix listed |
| ibm lotus notes | = r5 | No fix listed |
| ibm lotus notes | = r6 | No fix listed |
| verity keyview viewing sdk | = gold | No fix listed |
| winzip | = 7.0 | No fix listed |
| Microsoft windows 98 plus pack | All versions | No fix listed |
| Microsoft windows me | All versions | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
References
- 20021002 R7-0004: Multiple Vendor Long ZIP Entry Filename Processing Issues mailing-list
- 20021002 R7-0004: Multiple Vendor Long ZIP Entry Filename Processing Issues mailing-list
- 587 third-party-advisory
- www.info-zip.org
- www.info.apple.com
- win-zip-decompression-bo(10251) vdb-entry vendor-advisory
- VU#383779 third-party-advisory us-government-resource
- 5873 patch vdb-entry vendor-advisory
- MS02-054 vendor-advisory