CVE-2006-4033 Heap-based buffer overflow in Lhaplus.exe in Lhaplus 1.52, and possibly earlier versions, allows remote attackers to execute arbitrary code via an LZH archive with a long header, as specified by the e...
MediumCVSS 5.1
EPSS 5.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in Lhaplus.exe in Lhaplus 1.52, and possibly earlier versions, allows remote attackers to execute arbitrary code via an LZH archive with a long header, as specified by the extendedHeaderSize.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lhaplus | = 1.52 | No fix listed |
References
- 21256 patch third-party-advisory vendor-advisory
- 1351 third-party-advisory
- 1016615 patch vdb-entry vendor-advisory
- vuln.sg exploit
- 27667 vdb-entry
- 20060801 [vuln.sg] Lhaplus LHA Extended Header Handling Buffer Overflow Vulnerability mailing-list
- 19263 patch vdb-entry
- ADV-2006-3076 vdb-entry
- www7a.biglobe.ne.jp patch
- lhaplus-lzh-header-bo(28102) vdb-entry