PT-2017-7988 · Lha+1 · Lha+1

Paris Zoumpouloglou · Publicado 2016-04-21 · Atualizado 2020-07-27 · CVE-2016-1925

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions lha (affected versions not specified)

Description The issue is related to an integer underflow in the header.c file of lha, which can be triggered by a large header size value for the level0 or level1 header in an lha archive. This can lead to a buffer overflow, allowing remote attackers to have an unspecified impact.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Underflow

Enumeração de Fraquezas

CWE-191

Identificadores relacionados

CVE-2016-1925

MGASA-2016-0142

SUSE-SU-2016:1904-1

SUSE-SU-2016_1904-1

Produtos afetados

Suse

Lha

Referências · 12

• https://osv.dev/vulnerability/CVE-2016-1925 · Aviso do Fabricante
• https://bugzilla.suse.com/962528 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2016:1904-1 · Aviso do Fabricante
• https://security.gentoo.org/glsa/202007-42 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/01/18/3 · Nota
• https://advisories.mageia.org/MGASA-2016-0142.html · Nota de Segurança
• https://suse.com/security/cve/CVE-2016-1925 · Nota
• http://openwall.com/lists/oss-security/2016/01/18/8 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=17535 · Nota
• https://suse.com/support/update/announcement/2016/suse-su-20161904-1 · Nota
• https://osv.dev/vulnerability/MGASA-2016-0142 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1925 · Nota de Segurança