CVE-2003-1376

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

WinZip 8.0 uses weak random number generation for password protected ZIP files, which allows local users to brute force the encryption keys and extract the data from the zip file by guessing the state of the stream coder.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-255

Affected software

No affected versions have been published.

Timeline

Published
Dec 31, 2003
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2003

CVE-2003-13778.3Buffer overflow in the reverse DNS lookup of Smart IRC Daemon (SIRCD) 0.4.0 and 0.4.4 allows remote attackers to execute arbitrary code via CVE-2003-13788.8Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary prCVE-2003-13795.0clarkconnectd in ClarkConnect Linux 1.2 allows remote attackers to obtain sensitive information about the server via the characters (1) A, wCVE-2003-13807.5Directory traversal vulnerability in BisonFTP Server 4 release 2 allows remote attackers to (1) list directories above the root via an 'ls @CVE-2003-13816.8Format string vulnerability in AMX 0.9.2 and earlier, a plugin for Valve Software's Half-Life Server, allows remote attackers to execute arbCVE-2003-13827.5Buffer overflow in ISMail 1.4.3 and earlier allow remote attackers to execute arbitrary code via long domain names in (1) MAIL FROM or (2) RCVE-2003-13837.5WEB-ERP 0.1.4 and earlier allows remote attackers to obtain sensitive information via an HTTP request for the logicworks.ini file, which conCVE-2003-13844.3Cross-site scripting (XSS) vulnerability in index.php in PY-Livredor 1.0 allows remote attackers to insert arbitrary web script or HTML via CVE-2003-13856.8ipchat.php in Invision Power Board 1.1.1 allows remote attackers to execute arbitrary PHP code, if register_globals is enabled, by modifyingCVE-2003-13866.4AXIS 2400 Video Server 2.00 through 2.33 allows remote attackers to obtain sensitive information via an HTTP request to /support/messages, wCVE-2003-13877.5Buffer overflow in Opera 6.05 and 6.06, and possibly other versions, allows remote attackers to execute arbitrary code via a URL with a longCVE-2003-13889.3Buffer overflow in Opera 7.02 Build 2668 allows remote attackers to crash Opera via a long HTTP request ending in a .ZIP extension.
CVE-2003-1376: Medium severity, CVSS 4.6 | Vulnix