CVE-2004-0234: Clearswift Mailsweeper

High severity, CVSS 10.0. EPSS: 10.3% chance of exploitation in the next 30 days.

Multiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14, as used in products such as Barracuda Spam Firewall, allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive, which triggers the overflow when testing or extracting the archive.

Affected products

  • Clearswift Mailsweeper: version 4.0 only; version 4.1 only; version 4.2 only; version 4.3 only; version 4.3.3 only; version 4.3.4 only; …
  • F-Secure F-Secure Anti-Virus: version 4.51 only; version 4.52 only; version 4.60 only; version 5.5 only; version 5.41 only; version 5.42 only; …
  • F-Secure F-Secure For Firewalls: version 6.20 only
  • F-Secure F-Secure Internet Security: version 2003 only; version 2004 only
  • F-Secure F-Secure Personal Express: version 4.5 only; version 4.6 only; version 4.7 only
  • F-Secure Internet Gatekeeper: version 6.31 only; version 6.32 only
  • RARLAB WinRAR: version 3.20 only
  • Red Hat Fedora Core: version core_1.0 only
  • Red Hat Lha: version 1.14i-9 only
  • Sgi Propack: version 2.4 only; version 3.0 only
  • Stalker Cgpmcafee: version 3.2 only
  • Tsugio Okamoto Lha: version 1.14 only; version 1.15 only; version 1.17 only
  • Winzip Winzip: version 9.0 only

Published 2004-08-18. Last modified 2026-06-16.