LHa has a buffer overflow in its compression utility with unspecified impact.
|Package||app-arch/lha on all architectures|
|Affected versions||< 114i_p20201004|
|Unaffected versions||>= 114i_p20201004|
LHa is a console-based program for packing and unpacking LHarc archives.
A buffer overflow in LHa’s compression code was discovered which can be triggered by a crafted input file.
A remote attacker could send a specially crafted file possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All LHa users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/lha-114i_p20201004"
July 27, 2020
July 27, 2020: 1