CVE-2004-1027

Опубликовано: 01 мар. 2005

Источник: nvd

CVSS2: 5

EPSS Низкий

Описание

Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain .. (dot dot) sequences.

Ссылки

http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027348.html
Third Party Advisory
http://lwn.net/Articles/121827/
Third Party Advisory
http://security.gentoo.org/glsa/glsa-200411-29.xml
Third Party Advisory
http://www.debian.org/security/2005/dsa-628
Third Party Advisory
http://www.debian.org/security/2005/dsa-652
Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2005-007.html
Third Party Advisory
http://www.securityfocus.com/bid/11436
Patch
Third Party Advisory
VDB Entry
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17684
VDB Entry
http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027348.html
Third Party Advisory
http://lwn.net/Articles/121827/
Third Party Advisory
http://security.gentoo.org/glsa/glsa-200411-29.xml
Third Party Advisory
http://www.debian.org/security/2005/dsa-628
Third Party Advisory
http://www.debian.org/security/2005/dsa-652
Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2005-007.html
Third Party Advisory
http://www.securityfocus.com/bid/11436
Patch
Third Party Advisory
VDB Entry
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17684
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:arjsoftware:unarj:2.62:*:*:*:*:*:*:*

cpe:2.3:a:arjsoftware:unarj:2.63:a:*:*:*:*:*:*

cpe:2.3:a:arjsoftware:unarj:2.64:*:*:*:*:*:*:*

cpe:2.3:a:arjsoftware:unarj:2.65:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:gentoo:linux:*:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:debian:debian_linux:3.0:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.06284

Низкий

5 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

CVE-2004-1027

redhat

почти 21 год назад

CVE-2004-1027

debian

больше 20 лет назад

Directory traversal vulnerability in the -x (extract) command line opt ...

GHSA-8p77-cqww-99jh

github

больше 3 лет назад

BDU:2017-00281

fstec

больше 20 лет назад

Уязвимость библиотеки unarj, обеспечивающей архивацию данных, позволяющая нарушителю перезаписать произвольные файлы

EPSS

Процентиль: 91%

0.06284

Низкий

5 Medium

CVSS2

Дефекты

NVD-CWE-Other