CVE-2004-0771
NoneCVSS
—
EPSS
18.8%
Published
Nov 23, 2004
CISA due date
—
The record
Buffer overflow in the extract_one function from lhext.c in LHA may allow attackers to execute arbitrary code via a long w (working directory) command line option, a different issue than CVE-2004-0769. NOTE: this issue may be REJECTED if there are not any cases in which LHA is setuid or is otherwise used across security boundaries.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Red Hat:enterprise_linux:3::as | lha | 0 | 0:1.14i-10.4 |
| Red Hat:enterprise_linux:3::as | lha-debuginfo | 0 | 0:1.14i-10.4 |
| Red Hat:enterprise_linux:3::desktop | lha | 0 | 0:1.14i-10.4 |
| Red Hat:enterprise_linux:3::desktop | lha-debuginfo | 0 | 0:1.14i-10.4 |
| Red Hat:enterprise_linux:3::es | lha | 0 | 0:1.14i-10.4 |
| Red Hat:enterprise_linux:3::es | lha-debuginfo | 0 | 0:1.14i-10.4 |
| Red Hat:enterprise_linux:3::ws | lha | 0 | 0:1.14i-10.4 |
| Red Hat:enterprise_linux:3::ws | lha-debuginfo | 0 | 0:1.14i-10.4 |