CVE-2002-1684: Directory traversal vulnerability in (1) Deerfield D2Gfx 1.0.2 or (2) BadBlue Enterprise Edition 1.5.x and Bad

This month

MEDIUM 5.0DOWNGRADEDOWNGRADE

CVE-2002-1684 is a medium-severity flaw (CVSS 5.0) affecting d2gfx, badblue. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Directory traversal vulnerability in (1) Deerfield D2Gfx 1.0.2 or (2) BadBlue Enterprise Edition 1.5.x and BadBlue Personal Edition 1.5.6 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in the script used to read Microsoft Office documents.

Why this priority

EPSS top 8%: very likely to be exploited

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	5.0 (Medium)
EPSS exploit chance	4.9% (top 8%)
CISA exploited list	No
Published	2002-12-31
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: deerfield · working resources inc.

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2002-12-31 05:00 UTCPublished CVE record published
2026-06-16 21:59 UTCUpdated Record last modified

deerfield d2gfx DOWNGRADE

Affected: 1.0.2

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.0.2

1. Check installed version

apt-cache policy d2gfx || rpm -q d2gfx || d2gfx --version

2. No fixed release: DOWNGRADE to a release before 1.0.2 (Debian / Ubuntu)

apt-cache madison d2gfx sudo apt install d2gfx=<VERSION_BEFORE_1.0.2> sudo apt-mark hold d2gfx

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list d2gfx sudo dnf downgrade d2gfx-<VERSION_BEFORE_1.0.2> sudo dnf versionlock add d2gfx

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

working resources inc. badblue DOWNGRADE

Affected: enterprise_1.5 · personal_1.5.6_beta

Fixed in: no fixed release known

Safe to downgrade to: a release before enterprise_1.5

1. Check installed version

apt-cache policy badblue || rpm -q badblue || badblue --version

2. No fixed release: DOWNGRADE to a release before enterprise_1.5 (Debian / Ubuntu)

apt-cache madison badblue sudo apt install badblue=<VERSION_BEFORE_enterprise_1.5> sudo apt-mark hold badblue

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list badblue sudo dnf downgrade badblue-<VERSION_BEFORE_enterprise_1.5> sudo dnf versionlock add badblue

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2002-1684?

d2gfx: downgrade or apply the listed mitigation; badblue: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2002-1684 being exploited?

CVE-2002-1684 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2002-1684 affect?

CVE-2002-1684 affects d2gfx, badblue. Severity is medium (CVSS 5.0). Directory traversal vulnerability in (1) Deerfield D2Gfx 1.0.2 or (2) BadBlue Enterprise Edition 1.5.x and BadBlue Personal Edition 1.5.6 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in the script used to read M

How urgent is CVE-2002-1684?

Priority 41/100. EPSS top 8%: very likely to be exploited

Software pages

Microsoft Office vulnerabilities

References

← Back to latest CVEs