Description
Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes ("//absolute/path").
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | lha | 1.14i-2woody1 | DSA-515 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | lha | 1.14i-10.2 | RHSA-2004:178 |
Advisories 2
- RHSA-2004:178 Red Hat Security Advisory: lha security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-515 lha - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- CLA-2004:840 vendor-advisory
- FEDORA-2004-119 vendor-advisory
- 10243 vdb-entry
- 20040501 LHa buffer overflows and directory traversal problems mailing-list
- lha-directory-traversal(16013) vdb-entry
- RHSA-2004:179 vendor-advisory
- FLSA:1833 vendor-advisory
- DSA-515 vendor-advisory
- 20040510 [Ulf Harnhammar]: LHA Advisory + Patch mailing-list
- GLSA-200405-02 vendor-advisory
- RHSA-2004:178 vendor-advisory
- oval:org.mitre.oval:def:978 vdb-entry signature
- oval:org.mitre.oval:def:10409 vdb-entry signature