What’s Vulnerable › Vulnerabilities

CVE-2002-0370

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 43.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2002-10-10 · updated 2026-06-16

Description

Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames, including (1) Microsoft Windows 98 with Plus! Pack, (2) Windows XP, (3) Windows ME, (4) Lotus Notes R4 through R6 (pre-gold), (5) Verity KeyView, and (6) Stuffit Expander before 7.0.

Affected products

• Allume Systems Division Stuffit Expander: 6.5.2
• IBM Lotus Notes: through 4.5; 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5 (+5)
• Microsoft Windows 98 Plus Pack: all versions
• Microsoft Windows Me: all versions
• Microsoft Windows XP Service Pack 3: all versions
• Verity Keyview Viewing Sdk: gold
• WinZip Computing WinZip: 7.0

References

• http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0009.html
• http://marc.info/?l=bugtraq&m=103428193409223&w=2
• http://securityreason.com/securityalert/587
• http://www.info-zip.org/FAQ.html
• http://www.info.apple.com/usen/security/security_updates.html
• http://www.iss.net/security_center/static/10251.php
• http://www.kb.cert.org/vuls/id/383779
• http://www.securityfocus.com/bid/5873
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-054
• http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0009.html
• http://marc.info/?l=bugtraq&m=103428193409223&w=2
• http://securityreason.com/securityalert/587

Get alerted when CVE-2002-0370 or the next vulnerability affects your stack