CVE-2004-0947

Buffer overflow in unarj before 2.63a-r2 allows remote attackers to execute arbitrary code via an arj archive that contains long filenames

published November 24, 2004

CVSS
—
EPSS
7%
Percentile
94.4
In the wild
Unconfirmed
What it is

⚠️ A sneaky buffer overflow in unarj lets attackers slip in arbitrary code via long filenames in an ARJ archive! 💥 Don’t let your defenses down! Think of it like a package that bursts open because someone tried to shove in too many oversized items — the delivery service has no way to check if the contents are safe before they spill out! 📦 If exploited, an attacker could execute arbitrary code on your system, potentially leading to unauthorized access or even complete takeover. Imagine your computer acting like a puppet, dancing to someone else's tune — absolutely devastating!

Put simply

Think of it like a package that bursts open because someone tried to shove in too many oversized items — the delivery service has no way to check if the contents are safe before they spill out! 📦 This vulnerability arises from a buffer overflow in unarj versions before 2.63a-r2, allowing code execution when processing ARJ archives with excessively long filenames. Essentially, it's like a glitch in the system that lets attackers craft a file to overflow its memory limits.

What to do

If exploited, an attacker could execute arbitrary code on your system, potentially leading to unauthorized access or even complete takeover. Imagine your computer acting like a puppet, dancing to someone else's tune — absolutely devastating! To protect yourself, upgrade unarj to version 2.63a-r2 or later immediately. Also, consider implementing strict file validation checks to avoid accepting potentially harmful archives. 🛡️ You’ve got this! By following these steps, you’ll keep your system safe and sound. 🚀

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07369 · 94.4th percentile
Published
2004-11-24T05:00Z
EPSS history
Timeline
  • 24 NOV 05:00Z
    Buffer overflow in unarj before 2.63a-r2 allows remote attackers to execute arbitrary code via an arj archive that contains long filenames
    cvelistv5