CVE-2010-2434

CVSS V2 High 9.3 CVSS V3 None
Description
Buffer overflow in Arcext.dll 2.16.1 and earlier in pon software Explzh 5.62 and earlier allows remote attackers to execute arbitrary code via an LZH LHA file with a crafted header that is not properly handled during expansion.
Overview
  • CVE ID
  • CVE-2010-2434
  • Assigner
  • vultures@jpcert.or.jp
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2010-06-25T18:30:01
  • Last Modified Date
  • 2020-08-05T15:35:57
Weakness Enumerations
CWE URL
CWE-120 http://cwe.mitre.org/data/definitions/120.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:ponsoftware:explzh:*:*:*:*:*:*:*:* 1 OR 5.62
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:C/I:C/A:C
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • COMPLETE
  • Integrity Impact
  • COMPLETE
  • Availability Impact
  • COMPLETE
  • Base Score
  • 9.3
  • Severity
  • HIGH
  • Exploitability Score
  • 8.6
  • Impact Score
  • 10
References
Reference URL Reference Tags
http://jvn.jp/en/jp/JVN34729123/index.html Third Party Advisory Vendor Advisory
http://www.securityfocus.com/bid/41025 Third Party Advisory VDB Entry
http://secunia.com/advisories/40324 Third Party Advisory Vendor Advisory
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000026.html Third Party Advisory VDB Entry
http://www.ponsoftware.com/archiver/bug.htm#lzh_bufover Vendor Advisory
http://osvdb.org/65666 Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/59624 Third Party Advisory VDB Entry
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2010-2434
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2434
History
Created Old Value New Value Data Type Notes
2022-05-10 17:26:00 Added to TrackCVE