Description
LHA 1.14 and earlier allows attackers to execute arbitrary commands via a directory with shell metacharacters in its name.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | lha | 1.14i-10.4 | RHSA-2004:323 |
Advisories 1
- RHSA-2004:323 Red Hat Security Advisory: lha security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2004:323 vendor-advisory
- oval:org.mitre.oval:def:11088 vdb-entry signature
- FLSA:1833 vendor-advisory
- GLSA-200409-13 vendor-advisory
- lha-metacharacter-command-execution(17198) vdb-entry
- RHSA-2004:440 vendor-advisory