Advisory ROSA-SA-2023-2308

Software: libarchive 3.3.3
OS: ROSA Virtualization 2.1

package_evr_string: libarchive-3.3.3.3-5.0.1.rv3.src.rpm

CVE-ID: CVE-2018-1000879
BDU-ID: 2020-01816
CVE-Crit: HIGH
CVE-DESC.: A vulnerability in the archive_acl_from_text_lins function of the libarchive library is related to NULL pointer dereferencing. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service using a specially crafted archive
CVE-STATUS: Fixed
CVE-REV: To close, run the yum update libarchive command

CVE-ID: CVE-2018-1000880
BDU-ID: 2019-00927
CVE-Crit: HIGH
CVE-DESC.: A vulnerability in the _warc_read (archive_read_support_format_warc.c) function of the libarchive library is related to input validation errors leading to DOS - quasi-infinite execution and disk usage from a small file. Exploitation of the vulnerability allows an attacker acting remotely to cause a denial of service
CVE-STATUS: Resolved
CVE-REV: To close, run the yum update libarchive command