CVE-2004-0916 Directory traversal vulnerability in cabextract before 1.1 allows remote attackers to overwrite arbitrary files via a cabinet file containing .. (dot dot) sequences in a filename.
MediumCVSS 5.0
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in cabextract before 1.1 allows remote attackers to overwrite arbitrary files via a cabinet file containing .. (dot dot) sequences in a filename.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cabextract project cabextract | = 0.2 | No fix listed |
| cabextract project cabextract | = 0.6 | No fix listed |
| cabextract project cabextract | = 1.0 | No fix listed |
| debian/cabextract(Debian:12) | < 1.1-1 | 1.1-1 |
| debian/cabextract(Debian:13) | < 1.1-1 | 1.1-1 |
| debian/cabextract(Debian:14) | < 1.1-1 | 1.1-1 |
References
- 12882 patch third-party-advisory vendor-advisory
- DSA-574 patch vendor-advisory
- www.kyz.uklinux.net
- 11460 vdb-entry vendor-advisory
- cabextract-directory-traversal(17766) vdb-entry
- Debian Security Tracker CVE-2004-0916 vendor-advisory