Unscored severity · published Mar 1, 2005
CVE-2004-1027
Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that…
–
CVSS
2.7%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain .. (dot dot) sequences.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
3.0 · source: NVD
LI
Linux · Gentoo
All versions, or not specified · source: NVD
UN
Unarj · Arjsoftware
2.62; 2.63; 2.64; 2.65 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1027
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1027
Third Party Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027348.html
Third Party Advisory
http://lwn.net/Articles/121827/
Third Party Advisory
http://security.gentoo.org/glsa/glsa-200411-29.xml
Third Party Advisory
http://www.debian.org/security/2005/dsa-628
Third Party Advisory
http://www.debian.org/security/2005/dsa-652
Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2005-007.html