VulnerabilityModified

CVE-2004-1027

Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain ..

MEDIUM 5.0EPSS 2.74%

Does this matter?

Lower severity and a low EPSS score (2.74%). Track it; it rarely justifies an emergency change on its own.

Description

Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain .. (dot dot) sequences.

CVSS 2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS: 2.74% probability · 85th percentile
CISA KEV: Not listed
Affected: arjsoftware/unarj · gentoo/linux · debian/debian linux
Source: cve@mitre.org

References

http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027348.htmlThird Party Advisory
http://lwn.net/Articles/121827/Third Party Advisory
http://security.gentoo.org/glsa/glsa-200411-29.xmlThird Party Advisory
http://www.debian.org/security/2005/dsa-628Third Party Advisory
http://www.debian.org/security/2005/dsa-652Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2005-007.htmlThird Party Advisory
http://www.securityfocus.com/bid/11436Patch, Third Party Advisory, VDB Entry, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17684VDB Entry
http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027348.htmlThird Party Advisory
http://lwn.net/Articles/121827/Third Party Advisory
http://security.gentoo.org/glsa/glsa-200411-29.xmlThird Party Advisory
http://www.debian.org/security/2005/dsa-628Third Party Advisory
http://www.debian.org/security/2005/dsa-652Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2005-007.htmlThird Party Advisory
http://www.securityfocus.com/bid/11436Patch, Third Party Advisory, VDB Entry, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17684VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.