CVE:CVE-2016-2347
CNNVD:CNNVD-201604-002
Lhasa是软件开发者Simon Howard所研发的一套用于替代Unix中的LHA压缩程序的免费软件。该软件能够解压缩.lzh和.lzs文件。
Lhasa 0.3.1之前的版本中的lib/lha_file_header.c文件的‘the decode_level3_header’函数存在整数溢出漏洞。远程攻击者可借助特制的归档文件利用该漏洞执行任意代码。
solution:Upgrade opensuse leap to a higher version than 42.1,and avoid the version 42.1; Upgrade opensuse opensuse to a higher version than 13.2,and avoid the version 13.2; Upgrade debian debian_linux to a higher version than 7.0,8.0,and avoid the version 7.0,8.0; Upgrade lhasa_project lhasa to a higher version than 0.3.0,and avoid the version (,0.3.0]