VulnerabilityModified

CVE-2010-2434

Buffer overflow in Arcext.dll 2.16.1 and earlier in pon software Explzh 5.62 and earlier allows remote attackers to execute arbitrary code via an LZH LHA file with a crafted header that is not properly handled during expansion.

HIGH 9.3EPSS 5.36%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (5.36%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 2.0: 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS: 5.36% probability · 92th percentile
CISA KEV: Not listed
Weakness: CWE-120
Affected: ponsoftware/explzh
Source: vultures@jpcert.or.jp

References

http://jvn.jp/en/jp/JVN34729123/index.htmlThird Party Advisory, Vendor Advisory
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000026.htmlThird Party Advisory, VDB Entry
http://osvdb.org/65666Broken Link
http://secunia.com/advisories/40324Third Party Advisory, Vendor Advisory
http://www.ponsoftware.com/archiver/bug.htm#lzh_bufoverVendor Advisory
http://www.securityfocus.com/bid/41025Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/59624Third Party Advisory, VDB Entry
http://jvn.jp/en/jp/JVN34729123/index.htmlThird Party Advisory, Vendor Advisory
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000026.htmlThird Party Advisory, VDB Entry
http://osvdb.org/65666Broken Link
http://secunia.com/advisories/40324Third Party Advisory, Vendor Advisory
http://www.ponsoftware.com/archiver/bug.htm#lzh_bufoverVendor Advisory
http://www.securityfocus.com/bid/41025Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/59624Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.