Unscored severity · published Dec 31, 2004
CVE-2004-1773
Multiple buffer overflows in sharutils 4.2.1 and earlier may allow attackers to execute arbitrary code via (1) long output from wc to shar, or (2) unknown vectors in unshar
–
CVSS
3%
EPSS
No
On KEV
Description
Multiple buffer overflows in sharutils 4.2.1 and earlier may allow attackers to execute arbitrary code via (1) long output from wc to shar, or (2) unknown vectors in unshar.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
Sharutils · Gnu
4.2; 4.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1773
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1773
Patch
http://security.gentoo.org/glsa/glsa-200410-01.xml
www.redhat.com
http://www.redhat.com/support/errata/RHSA-2005-377.html
Patch
http://www.securityfocus.com/bid/11298
Patch
https://bugzilla.fedora.us/show_bug.cgi?id=2155
oval.cisecurity.org
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11093
More from Sharutils
7.8
CVE-2018-1000097
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code
–
CVE-2005-0990
unshar (unshar.c) in sharutils 4.2.1 allows local users to overwrite arbitrary files via a symlink attack on the unsh.X temporary file
–
CVE-2004-1772
Stack-based buffer overflow in shar in GNU sharutils 4.2.1 allows local users to execute arbitrary code via a long -o command line argument
–
CVE-2002-0178
uudecode, as available in the sharutils package before 4.2.1, does not check whether the filename of the uudecoded file is a pipe or symbolic link, which could allow attackers to…