{"id":"CVE-2004-0771","url":"https://www.cyber-defence.io/tools/cve/CVE-2004-0771","generatedAt":"2026-10-27T19:37:04.666Z","title":"Buffer overflow in the extract_one function from lhext.c in LHA may allow attackers to execute arbitrary code via a long w (working directory) command line option, a different issue than CVE-2004-0769.","description":"Buffer overflow in the extract_one function from lhext.c in LHA may allow attackers to execute arbitrary code via a long w (working directory) command line option, a different issue than CVE-2004-0769. NOTE: this issue may be REJECTED if there are not any cases in which LHA is setuid or is otherwise used across security boundaries.","published":"2004-11-23T05:00:00.000Z","lastModified":"2026-06-16T22:06:21.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":10,"severity":"HIGH","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C"},"cwe":[],"affected":["tsugio okamoto/lha"],"epss":{"score":0.18827,"percentile":0.97262,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2004-05-19","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":24120,"kind":"exploit","title":"LHA 1.x - 'extract_one' Multiple Buffer Overflow Vulnerabilities","url":"https://www.exploit-db.com/exploits/24120","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/24120.pl","file":"exploits/linux/remote/24120.pl","published":"2004-05-19","added":"2004-05-19","updated":"2017-11-15","author":"Lukasz Wojtow","type":"remote","platform":"linux","port":null,"verified":true,"codes":["CVE-2004-0771","OSVDB-9520"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/10354/info"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 18.8%, higher than 97% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://bugs.gentoo.org/show_bug.cgi?id=51285","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=108668791510153","source":"cve@mitre.org"},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200409-13.xml","source":"cve@mitre.org"},{"url":"http://www.redhat.com/support/errata/RHSA-2004-323.html","source":"cve@mitre.org"},{"url":"http://www.redhat.com/support/errata/RHSA-2004-440.html","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/363418","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/10354","tags":["Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://bugzilla.fedora.us/show_bug.cgi?id=1833","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/16196","source":"cve@mitre.org"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9595","source":"cve@mitre.org"},{"url":"http://bugs.gentoo.org/show_bug.cgi?id=51285","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://marc.info/?l=bugtraq&m=108668791510153","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200409-13.xml","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.redhat.com/support/errata/RHSA-2004-323.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.redhat.com/support/errata/RHSA-2004-440.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/363418","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/10354","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.fedora.us/show_bug.cgi?id=1833","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/16196","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9595","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2004-0771","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}