Lucene search

[email protected]CVE-2020-24175

HistoryFeb 22, 2021 - 4:15 p.m.

CVE-2020-24175

2021-02-2216:15:12

CWE-787

[email protected]

web.nvd.nist.gov

cve-2020-24175

buffer overflow

yz1

izarc

zipgenius

explzh

code execution

archive file

security vulnerability

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

68.8%

JSON

Buffer overflow in Yz1 0.30 and 0.32, as used in IZArc 4.4, ZipGenius 6.3.2.3116, and Explzh (extension) 8.14, allows attackers to execute arbitrary code via a crafted archive file, related to filename handling.

Affected configurations

NVD

Node

yz1yz1Match0.30

yz1yz1Match0.32

CPENameOperatorVersion
yz1:yz1yz1eq0.30
yz1:yz1yz1eq0.32

CPE	Name	Operator	Version
yz1:yz1	yz1	eq	0.30
yz1:yz1	yz1	eq	0.32

References

yz1.com

gist.github.com/illikainen/315a420a9c28cbe882e16b8eba40b2e1

gist.github.com/illikainen/ced14e08e00747fef613ba619bb25bb4

illikainen.dev/advisories/014-yz1-izarc

Social References

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

68.8%

JSON

Related for CVE-2020-24175

cvelist1 prion1 nvd1