« Volver al listado

CVE-2007-3375

Estado: ModificadaMedia (6.8)—

Stack-based buffer overflow in Lhaca File Archiver before 1.21 allows user-assisted remote attackers to execute arbitrary code via a crafted LZH archive, as exploited by malware such as Trojan.Lhdropper.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Lhaca — File Archiver

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-3375",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-06-25T20:30:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/25826",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://vuln.sg/lhaca121-en.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/871497",
      "tags": [
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/24604",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.symantec.com/enterprise/security_response/weblog/2007/06/beware_of_lzh.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.symantec.com/security_response/writeup.jsp?docid=2007-062506-5500-99&tabid=1",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35116",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/25826",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://vuln.sg/lhaca121-en.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/871497",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/24604",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.symantec.com/enterprise/security_response/weblog/2007/06/beware_of_lzh.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.symantec.com/security_response/writeup.jsp?docid=2007-062506-5500-99&tabid=1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35116",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stack-based buffer overflow in Lhaca File Archiver before 1.21 allows user-assisted remote attackers to execute arbitrary code via a crafted LZH archive, as exploited by malware such as Trojan.Lhdropper."
    },
    {
      "lang": "es",
      "value": "Un desbordamiento de búfer en la región stack de la memoria en Lhaca File Archiver versiones anteriores a 1.21, permite a atacantes remotos asistidos por el usuario ejecutar código arbitrario por medio de un archivo LZH diseñado, como es explotado mediante un malware tal y como Trojan.Lhdropper."
    }
  ],
  "lastModified": "2026-06-16T22:41:51.980",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lhaca:file_archiver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BA36480-BB11-4A81-BA1D-CAC28B025CA4",
              "versionEndIncluding": "1.20"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "vendorComments": [
    {
      "comment": "Not vulnerable, Red Hat do not ship the Lhaca file archiver.  Note that an identical flaw was found affecting the lha file archiver in 2004, CVE-2004-0234.  This issue was corrected by security update RHSA-2004:178 for Red Hat Enterprise Linux 2.1 and 3.  Red Hat\nEnterprise Linux 4 was not vulnerable as it contained a backported patch to correct this issue from release.\nhttp://rhn.redhat.com/errata/RHSA-2004-178.html\n",
      "lastModified": "2007-07-10T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}