Updated unrar packages fix security vulnerabilities

🗓️ 24 Aug 2017 21:18:23Reported by Gentoo FoundationType

Updated unrar packages fix security vulnerabilities including directory traversal, out-of-bounds reads, and buffer overflow issues in UnRAR prior to version 5.5.7

Reporter	Title	Published	Views	Family All 65
BDU FSTEC	The vulnerability of the Unpack::LongLZ function in the libunrar.a library, a file decompression tool for the UnRAR archive, allows a malicious actor to cause the application to terminate abnormally.	8 Sep 201700:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Unpack::Unpack20 function in the libunrar.a library, a file archiver for the UnRAR archive format, allows a malicious actor to cause the application to terminate abnormally.	8 Sep 201700:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Archive::ReadHeader15 function in the libunrar.a library, a tool for decompressing UnRAR files, allows a malicious actor to cause an unexpected termination of the application.	8 Sep 201700:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the UnRAR decompression tool lies in its lack of name-based path limitation, which allows attackers to access confidential data.	26 Dec 202300:00	–	bdu_fstec
CNVD	UnRAR 'Archive::ReadHeader15' function out-of-bounds read vulnerability	25 Aug 201700:00	–	cnvd
CNVD	UnRAR 'Unpack::LongLZ' Function Buffer Overflow Vulnerability	21 Aug 201700:00	–	cnvd
CNVD	UnRAR 'Unpack::Unpack20' function out-of-bounds read vulnerability	21 Aug 201700:00	–	cnvd
CNVD	UnRAR Directory Traversal Vulnerability	21 Aug 201700:00	–	cnvd
CVE	CVE-2017-12938	18 Aug 201713:00	–	cve
CVE	CVE-2017-12940	18 Aug 201714:00	–	cve

OS	OS Version	Architecture	Package	Package Version	Filename
Mageia	6	any	unrar	5.50-1	unrar-5.50-1.noarch.rpm

Source	Link
bugs	www.bugs.mageia.org/show_bug.cgi
openwall	www.openwall.com/lists/oss-security/2017/08/18/2
openwall	www.openwall.com/lists/oss-security/2017/08/18/6

24 Aug 2017 21:18Current

5Medium risk

Vulners AI Score5

CVSS 27.5

CVSS 39.8

EPSS0.0089