CVE-2004-0769 Buffer overflow in LHA allows remote attackers to execute arbitrary code via long pathnames in LHarc format 2 headers for a .LHZ archive, as originally demonstrated using the "x" option but also explo...
HighCVSS 10.0
EPSS 9.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in LHA allows remote attackers to execute arbitrary code via long pathnames in LHarc format 2 headers for a .LHZ archive, as originally demonstrated using the "x" option but also exploitable through "l" and "v", and fixed in header.c, a different issue than CVE-2004-0771.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla bugzilla | All versions | No fix listed |
References
- bugs.gentoo.org exploit patch vendor-advisory
- lw.ftw.zamosc.pl
- 20040616 Re: [SECURITY] [DSA 515-1] New lha packages fix several vulnerabilities; Re: mailing-list
- GLSA-200409-13 vendor-advisory
- RHSA-2004:323 vendor-advisory
- RHSA-2004:440 vendor-advisory
- FLSA:1833 vendor-advisory
- lha-long-pathname-bo(16917) vdb-entry
- oval:org.mitre.oval:def:11047 signature vdb-entry