VulnerabilityModified
CVE-2004-0235
Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes…
MEDIUM 6.4EPSS 4.12%
Does this matter?
Lower severity and a low EPSS score (4.12%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes ("//absolute/path").
- CVSS 2.0
- 6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
- EPSS
- 4.12% probability · 90th percentile
- CISA KEV
- Not listed
- Affected
- clearswift/mailsweeper · f-secure/f-secure anti-virus · f-secure/f-secure for firewalls · f-secure/f-secure internet security · f-secure/f-secure personal express · f-secure/internet gatekeeper · rarlab/winrar · redhat/lha · sgi/propack · stalker/cgpmcafee · tsugio okamoto/lha · winzip/winzip · redhat/fedora core
- Source
- cve@mitre.org
References
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000840
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/020776.html
- http://marc.info/?l=bugtraq&m=108422737918885&w=2
- http://security.gentoo.org/glsa/glsa-200405-02.xml
- http://www.debian.org/security/2004/dsa-515
- http://www.redhat.com/archives/fedora-announce-list/2004-May/msg00005.html
- http://www.redhat.com/support/errata/RHSA-2004-178.html
- http://www.redhat.com/support/errata/RHSA-2004-179.html
- http://www.securityfocus.com/bid/10243Exploit, Patch, Vendor Advisory
- https://bugzilla.fedora.us/show_bug.cgi?id=1833
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16013
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10409
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A978
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000840
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/020776.html
- http://marc.info/?l=bugtraq&m=108422737918885&w=2
- http://security.gentoo.org/glsa/glsa-200405-02.xml
- http://www.debian.org/security/2004/dsa-515
- http://www.redhat.com/archives/fedora-announce-list/2004-May/msg00005.html
- http://www.redhat.com/support/errata/RHSA-2004-178.html
- http://www.redhat.com/support/errata/RHSA-2004-179.html
- http://www.securityfocus.com/bid/10243Exploit, Patch, Vendor Advisory
- https://bugzilla.fedora.us/show_bug.cgi?id=1833
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16013
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10409
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A978
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.