USN-9073-1: Lhasa vulnerability
It was discovered that Lhasa incorrectly handled certain LHA archive headers, leading to an integer underflow. If a user or automated system were tricked into opening a specially crafted archive, an attacker could possibly use this issue to cause Lhasa to crash or execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/lhasato a version that resolves this vulnerability.Fixed in 0.3.0-2ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/liblhasa0to a version that resolves this vulnerability.Fixed in 0.3.0-2ubuntu0.1~esm1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users or automated systems that open specially crafted LHA archives with Lhasa or software using liblhasa0 may be exposed.
What does an attacker need to exploit it?
An attacker needs to cause a user or automated system to open a specially crafted LHA archive.
What could successful exploitation cause?
The issue could cause Lhasa to crash or potentially allow execution of arbitrary code.