CVE-2004-0769 Memory corruption in n/a

Critical 10.0 Published 4 Aug 2004 Updated 8 Aug 2024

Remote attackers can execute arbitrary code via buffer overflow in LHA when processing malicious LHarc archives, requiring user interaction to open the file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2004-0769?

CVE-2004-0769 is a critical memory corruption vulnerability in Mozilla Bugzilla, published on 4 Aug 2004. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Buffer overflow in LHA allows remote attackers to execute arbitrary code via long pathnames in LHarc format 2 headers for a .LHZ archive, as originally demonstrated using the "x" option but also exploitable through "l" and "v", and fixed in header.c, a different issue than CVE-2004-0771.

Which versions are affected by CVE-2004-0769?

It affects 1 product.

Products include Mozilla Bugzilla.

How do I fix CVE-2004-0769?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2004-0769 being exploited?

There is no known exploitation of CVE-2004-0769 in the wild and no public exploit code.

All Mozilla Bugzilla vulnerabilities

Sources

Also known as GHSA-2mcr-985f-frgr.