Description
Multiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14, as used in products such as Barracuda Spam Firewall, allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive, which triggers the overflow when testing or extracting the archive.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | lha | 1.14i-2woody1 | DSA-515 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | lha | 1.14i-10.2 | RHSA-2004:178 |
Advisories 2
- RHSA-2004:178 Red Hat Security Advisory: lha security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-515 lha - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1015866 vdb-entry
- CLA-2004:840 vendor-advisory
- 5753 vdb-entry
- oval:org.mitre.oval:def:977 vdb-entry signature
- FEDORA-2004-119 vendor-advisory
- 20060403 Barracuda LHA archiver security bug leads to remote compromise mailing-list
- 10243 vdb-entry
- ADV-2006-1220 vdb-entry
- 20040501 LHa buffer overflows and directory traversal problems mailing-list
- 19514 third-party-advisory
- 5754 vdb-entry
- RHSA-2004:179 vendor-advisory
- http://www.guay-leroux.com/projects/barracuda-advisory-LHA.txt
- FLSA:1833 vendor-advisory
- DSA-515 vendor-advisory
- oval:org.mitre.oval:def:9881 vdb-entry signature
- 20040510 [Ulf Harnhammar]: LHA Advisory + Patch mailing-list
- GLSA-200405-02 vendor-advisory
- RHSA-2004:178 vendor-advisory
- lha-multiple-bo(16012) vdb-entry
- 20040502 Lha local stack overflow Proof Of Concept Code mailing-list