Unscored CVE-2004-1027 EUVD-2004-1025GHSA-8p77-cqww-99jh

Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via…

Published Nov 16, 2004 · Updated Aug 8, 2024 · Assigned by mitre

Description

Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain .. (dot dot) sequences.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 3.0	unarj	2.43-3woody1	DSA-652-1

Advisories 1

DSA-652-1 unarj Debian Security (DSA / DLA) · Mar 9, 2026

References

unarj-directory-traversal(17684) vdb-entry
DSA-652 vendor-advisory
RHSA-2005:007 vendor-advisory
DSA-628 vendor-advisory
11436 vdb-entry
FLSA:2272 vendor-advisory
GLSA-200411-29 vendor-advisory
20041010 unarj dir-transversal bug (../../../..) mailing-list