CVE catalog
CVE-2004-0235
lha - several vulnerabilities
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 4.12% · Oct 25, 2026
Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes ("//absolute/path"). security flaw
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | lha | 3.0 | 1.00-3 | vulnerable |
| Debian | lha | 3.0 | 1.00-5 | vulnerable |
| Debian | lha | 3.0 | 1.00-6 | vulnerable |
| Debian | lha | 3.0 | 1.14c-1 | vulnerable |
| Debian | lha | 3.0 | 1.14e-0 | vulnerable |
| Debian | lha | 3.0 | 1.14i-2 | vulnerable |
| Debian | lha | 3.0 | 1.14i-2woody1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | lha | deb | 3.0 | 1.14i-2woody1 | Not reported | DSA-515 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: