FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2004-1010

This CVE name corresponds to:

Entered	Topic
2004-12-01	zip -- long path buffer overflow

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2004-1010 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2004-1010
Phase	Assigned(20041104)

Description

Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.

References

Source	Reference
BUGTRAQ	20041103 [HV-MED] Zip/Linux long path buffer overflow
FULLDISC	20041103 [HV-MED] Zip/Linux long path buffer overflow
MISC	http://www.hexview.com/docs/20041103-1.txt
CONFIRM	http://www.info-zip.org/FAQ.html
DEBIAN	DSA-624
FEDORA	FLSA:2255
GENTOO	GLSA-200411-16
MANDRAKE	MDKSA-2004:141
REDHAT	RHSA-2004:634
TURBO	TLSA-2005-18
UBUNTU	USN-18-1
CIAC	P-072
BID	11603
OVAL	oval:org.mitre.oval:def:9848
SECUNIA	13094
XF	infozip-compressed-folder-bo(17956)