Unscored severity · published Oct 11, 2002
CVE-2002-1139
The Compressed Folders feature in Microsoft Windows 98 with Plus! Pack, Windows Me, and Windows XP does not properly check the destination folder during the decompression of ZIP…
–
CVSS
4.2%
EPSS
No
On KEV
Description
The Compressed Folders feature in Microsoft Windows 98 with Plus! Pack, Windows Me, and Windows XP does not properly check the destination folder during the decompression of ZIP files, which allows attackers to place an executable file in a known location on a user's system, aka "Incorrect Target Path for Zipped File Decompression."
Exploitation
Is it being used?
Exploit prediction (EPSS)4.2% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
W9
Windows 98 Plus Pack · Microsoft
All versions, or not specified · source: NVD
WM
Windows ME · Microsoft
All versions, or not specified · source: NVD
WX
Windows XP · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-1139
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-1139
Vendor Advisory
http://www.iss.net/security_center/static/10252.php
www.securityfocus.com
http://www.securityfocus.com/bid/5876
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-054
More from Windows 98 Plus Pack
–
CVE-2002-0370
Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with…