CVE-2004-1010 Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.
HighCVSS 10.0
EPSS 9.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| info-zip zip | = 2.3 | No fix listed |
| debian/zip(Debian:12) | < 2.30-8 | 2.30-8 |
| debian/zip(Debian:13) | < 2.30-8 | 2.30-8 |
| debian/zip(Debian:14) | < 2.30-8 | 2.30-8 |
References
- 20041103 [HV-MED] Zip/Linux long path buffer overflow mailing-list
- 20041103 [HV-MED] Zip/Linux long path buffer overflow mailing-list
- 13094 third-party-advisory
- GLSA-200411-16 vendor-advisory
- P-072 government-resource third-party-advisory
- DSA-624 vendor-advisory
- www.hexview.com
- www.info-zip.org
- MDKSA-2004:141 vendor-advisory
- RHSA-2004:634 vendor-advisory
- 11603 patch vdb-entry vendor-advisory
- TLSA-2005-18 vendor-advisory
- FLSA:2255 vendor-advisory
- infozip-compressed-folder-bo(17956) vdb-entry
- oval:org.mitre.oval:def:9848 signature vdb-entry
- USN-18-1 vendor-advisory
- Debian Security Tracker CVE-2004-1010 vendor-advisory