{"id": "CVE-2017-8844", "bulletinFamily": "NVD", "title": "CVE-2017-8844", "description": "The read_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted archive.", "published": "2017-05-08T14:29:00", "modified": "2020-05-13T01:15:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-8844", "reporter": "cve@mitre.org", "references": ["https://blogs.gentoo.org/ago/2017/05/07/lrzip-heap-based-buffer-overflow-write-in-read_1g-stream-c/", "https://security.gentoo.org/glsa/202005-01", "https://github.com/ckolivas/lrzip/issues/70"], "cvelist": ["CVE-2017-8844"], "type": "cve", "lastseen": "2020-10-03T13:07:50", "edition": 4, "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "gentoo", "idList": ["GLSA-202005-01"]}, {"type": "nessus", "idList": ["GENTOO_GLSA-202005-01.NASL"]}], "modified": "2020-10-03T13:07:50", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2020-10-03T13:07:50", "rev": 2}, "vulnersScore": 6.7}, "cpe": ["cpe:/a:lrzip_project:lrzip:0.631"], "affectedSoftware": [{"cpeName": "lrzip_project:lrzip", "name": "lrzip project lrzip", "operator": "eq", "version": "0.631"}], "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "cpe23": ["cpe:2.3:a:lrzip_project:lrzip:0.631:*:*:*:*:*:*:*"], "cwe": ["CWE-119"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:lrzip_project:lrzip:0.631:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}}

{"gentoo": [{"lastseen": "2020-05-13T03:06:48", "bulletinFamily": "unix", "cvelist": ["CVE-2017-8846", "CVE-2017-9929", "CVE-2017-8847", "CVE-2017-9928", "CVE-2017-8844", "CVE-2017-8843", "CVE-2017-8842", "CVE-2017-8845"], "description": "### Background\n\nOptimized for compressing large files\n\n### Description\n\nMultiple vulnerabilities have been discovered in Long Range ZIP. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could entice a user to open a specially crafted archive file possibly resulting in a Denial of Service condition. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Long Range ZIP users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=app-arch/lrzip-0.631_p20190619\"", "edition": 1, "modified": "2020-05-12T00:00:00", "published": "2020-05-12T00:00:00", "id": "GLSA-202005-01", "href": "https://security.gentoo.org/glsa/202005-01", "title": "Long Range ZIP: Multiple vulnerabilities", "type": "gentoo", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2020-05-16T02:16:57", "description": "The remote host is affected by the vulnerability described in GLSA-202005-01\n(Long Range ZIP: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Long Range ZIP. Please\n review the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker could entice a user to open a specially crafted\n archive file possibly resulting in a Denial of Service condition.\n \nWorkaround :\n\n There is no known workaround at this time.", "edition": 2, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2020-05-13T00:00:00", "title": "GLSA-202005-01 : Long Range ZIP: Multiple vulnerabilities", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-8846", "CVE-2017-9929", "CVE-2017-8847", "CVE-2017-9928", "CVE-2017-8844", "CVE-2017-8843", "CVE-2017-8842", "CVE-2017-8845"], "modified": "2020-05-13T00:00:00", "cpe": ["cpe:/o:gentoo:linux", "p-cpe:/a:gentoo:linux:lrzip"], "id": "GENTOO_GLSA-202005-01.NASL", "href": "https://www.tenable.com/plugins/nessus/136538", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 202005-01.\n#\n# The advisory text is Copyright (C) 2001-2020 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(136538);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/05/15\");\n\n script_cve_id(\"CVE-2017-8842\", \"CVE-2017-8843\", \"CVE-2017-8844\", \"CVE-2017-8845\", \"CVE-2017-8846\", \"CVE-2017-8847\", \"CVE-2017-9928\", \"CVE-2017-9929\");\n script_xref(name:\"GLSA\", value:\"202005-01\");\n\n script_name(english:\"GLSA-202005-01 : Long Range ZIP: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-202005-01\n(Long Range ZIP: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Long Range ZIP. Please\n review the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker could entice a user to open a specially crafted\n archive file possibly resulting in a Denial of Service condition.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/202005-01\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All Long Range ZIP users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=app-arch/lrzip-0.631_p20190619'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:lrzip\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/05/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/05/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/05/13\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"app-arch/lrzip\", unaffected:make_list(\"ge 0.631_p20190619\"), vulnerable:make_list(\"lt 0.631_p20190619\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Long Range ZIP\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}]}