Vulnerability in Allume Systems Division Stuffit Expander
CVE-2002-0370
Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames, including (1) Microsoft Windows 98 with Plus! Pack, (2) Windows XP, (3) Windows ME, (4) Lotus Notes R4 through R6 (pre-gold), (5) Verity KeyView, and (6) Stuffit Expander before 7.0.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.433 (98.7th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 99th percentile — 98.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.433 · newest: 0.433 · change: 0.000
Affected products
- Allume Systems Division Stuffit Expander — versions 6.5.2
- IBM Lotus Notes — versions 5.0, 5.0.1, 5.0.2
- Microsoft Windows 98 Plus Pack
- Microsoft Windows Me
- Microsoft Windows Xp
- Verity Keyview Viewing Sdk — versions gold
- Winzip — versions 7.0
References
- www.info.apple.com/usen/security/security_updates.html
- www.info-zip.org/FAQ.html
- www.iss.net/security_center/static/10251.php (vdb-entry, Vendor Advisory)
- archives.neohapsis.com/archives/vulnwatch/2002-q4/0009.html (mailing-list)
- securityreason.com/securityalert/587 (third-party-advisory)
- marc.info/ (mailing-list)
- www.kb.cert.org/vuls/id/383779 (US Government Resource, Third Party Advisory, third-party-advisory)
- docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-054 (vendor-advisory)
- www.securityfocus.com/bid/5873 (Patch, vdb-entry, Vendor Advisory)