What’s Vulnerable › Vulnerabilities

CVE-2004-0235

• Severity: medium (CVSS 6.4 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2004-08-18 · updated 2026-06-16

Description

Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes ("//absolute/path").

Affected products

• Clearswift Mailsweeper: 4.0, 4.1, 4.2, 4.3, 4.3.3, 4.3.4 (+8)
• F-Secure Anti-Virus: 4.51, 4.52, 4.60, 5.5, 5.41, 5.42 (+4)
• F-Secure For Firewalls: 6.20
• F-Secure Internet Security: 2003, 2004
• F-Secure Personal Express: 4.5, 4.6, 4.7
• F-Secure Internet Gatekeeper: 6.31, 6.32
• WinRAR: 3.20
• RedHat Fedora Core: core_1.0
• RedHat Lha: 1.14i-9
• Sgi Propack: 2.4, 3.0
• Stalker Cgpmcafee: 3.2
• Tsugio Okamoto Lha: 1.14, 1.15, 1.17
• WinZip Computing WinZip: 9.0

References

• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000840
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/020776.html
• http://marc.info/?l=bugtraq&m=108422737918885&w=2
• http://security.gentoo.org/glsa/glsa-200405-02.xml
• http://www.debian.org/security/2004/dsa-515
• http://www.redhat.com/archives/fedora-announce-list/2004-May/msg00005.html
• http://www.redhat.com/support/errata/RHSA-2004-178.html
• http://www.redhat.com/support/errata/RHSA-2004-179.html
• http://www.securityfocus.com/bid/10243
• https://bugzilla.fedora.us/show_bug.cgi?id=1833
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16013
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10409

Get alerted when CVE-2004-0235 or the next vulnerability affects your stack