debian/ncompress vulnerabilities

Latest debian/ncompress CVEs

Newest publication first

1. DSA-2074-1 ncompress - execution of arbitrary code

   Published 2010-07-21

   Unknown

2. CVE-2010-0001 Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms, as used in ncompress and probably others, allows remote attackers to cause a denial of service (application c...

   Published 2010-01-29

   Medium·CVSS 6.8 EPSS 4.8%

   Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms, as used in ncompress and probably others, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted archive that uses LZW com...

3. CVE-2006-1168 The decompress function in compress42.c in (1) ncompress 4.2.4 and (2) liblzw allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code, via crafted data that l...

   Published 2006-08-14

   High·CVSS 7.5 EPSS 5.8%

   The decompress function in compress42.c in (1) ncompress 4.2.4 and (2) liblzw allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code, via crafted data that leads to a buffer underflow.

4. DSA-1149-1 ncompress - buffer underflow

   Published 2006-08-10

   Unknown

5. CVE-2005-2991 ncompress 4.2.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files using (1) zdiff or (2) zcmp, a different vulnerability than CVE-2004-0970.

   Published 2005-09-20

   Low·CVSS 2.1 EPSS 0.37%

   ncompress 4.2.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files using (1) zdiff or (2) zcmp, a different vulnerability than CVE-2004-0970.

6. CVE-2001-1413 Stack-based buffer overflow in the comprexx function for ncompress 4.2.4 and earlier, when used in situations that cross security boundaries (such as FTP server), may allow remote attackers to execute...

   Published 2004-10-20

   High·CVSS 7.5 EPSS 4.8%

   Stack-based buffer overflow in the comprexx function for ncompress 4.2.4 and earlier, when used in situations that cross security boundaries (such as FTP server), may allow remote attackers to execute arbitrary code via a long filename argument.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.