CVE-2020-24175

Опубликовано: 22 фев. 2021

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

Buffer overflow in Yz1 0.30 and 0.32, as used in IZArc 4.4, ZipGenius 6.3.2.3116, and Explzh (extension) 8.14, allows attackers to execute arbitrary code via a crafted archive file, related to filename handling.

Ссылки

http://yz1.com
Permissions Required
Product
https://gist.github.com/illikainen/315a420a9c28cbe882e16b8eba40b2e1
Exploit
Third Party Advisory
https://gist.github.com/illikainen/ced14e08e00747fef613ba619bb25bb4
Exploit
Third Party Advisory
https://illikainen.dev/advisories/014-yz1-izarc
Exploit
Third Party Advisory
http://yz1.com
Permissions Required
Product
https://gist.github.com/illikainen/315a420a9c28cbe882e16b8eba40b2e1
Exploit
Third Party Advisory
https://gist.github.com/illikainen/ced14e08e00747fef613ba619bb25bb4
Exploit
Third Party Advisory
https://illikainen.dev/advisories/014-yz1-izarc
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:yz1:yz1:0.30:*:*:*:*:*:*:*

cpe:2.3:a:yz1:yz1:0.32:*:*:*:*:*:*:*

EPSS

Процентиль: 82%

0.01725

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-787

Связанные уязвимости

GHSA-4hh5-2hp6-3q94

github

больше 3 лет назад