CVE-2019-1000019

libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards release v3.0.2 onwards contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archivereadsupportformat7zip.c, headerbytes that can result in a crash denial of service. This attack appears to be...

UBUNTU-CVE-2019-1000019

libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards release v3.0.2 onwards contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archivereadsupportformat7zip.c, headerbytes that can result in a crash denial of service. This attack appears to be...

libarchive/libarchive_fuzzer: Heap-buffer-overflow in read_bits_16

Project: https://github.com/libarchive/libarchive.git Detailed report: https://oss-fuzz.com/testcase?key=5637848603033600 Project: libarchive Fuzzer: afllibarchivefuzzer Fuzz target binary: libarchivefuzzer Job Type: aflasanlibarchive Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Cra...

USN-3859-1: libarchive vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description It was discovered that libarchive incorrectly handled certain archive files. An attacker could possibly use this issue to cause a denial of service...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : libarchive vulnerabilities (USN-3859-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3859-1 advisory. It was discovered that libarchive incorrectly handled certain archive files. An attacker could possibly use this issue to cause a...

Ubuntu: Security Advisory (USN-3859-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3859-1: libarchive vulnerabilities

It was discovered that libarchive incorrectly handled certain archive files. An attacker could possibly use this issue to cause a denial of service. CVE-2018-1000880 affected only Ubuntu 18.04 LTS and Ubuntu 18.10. CVE-2018-1000877, CVE-2018-1000878, CVE-2018-1000880 It was discovered that...

USN-3859-1 libarchive vulnerabilities

It was discovered that libarchive incorrectly handled certain archive files. An attacker could possibly use this issue to cause a denial of service. CVE-2018-1000880 affected only Ubuntu 18.04 LTS and Ubuntu 18.10. CVE-2018-1000877, CVE-2018-1000878, CVE-2018-1000880 It was discovered that...

Updated libarchive packages fix security vulnerabilities

readheader in archivereadsupportformatrar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archivereadformatrarreadheader CVE-2017-14502. Multiple security issues were found in libarchive: Processing malformed RAR archive...

MGASA-2019-0030 Updated libarchive packages fix security vulnerabilities

readheader in archivereadsupportformatrar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archivereadformatrarreadheader CVE-2017-14502. Multiple security issues were found in libarchive: Processing malformed RAR archive...

libarchive/libarchive_fuzzer: Stack-buffer-overflow in parse_tables

Project: https://github.com/libarchive/libarchive.git Detailed report: https://oss-fuzz.com/testcase?key=5700900719427584 Project: libarchive Fuzzer: afllibarchivefuzzer Fuzz target binary: libarchivefuzzer Job Type: aflasanlibarchive Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 7...

CVE-2018-1000877

libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards release v3.1.0 onwards contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archivereadsupportformatrar.c, parsecodes, reallocrar-lzss.window, newsize with newsize = 0 that can result in Crash/DoS. Thi...

CVE-2018-1000878

libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards release v3.1.0 onwards contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archivereadsupportformatrar.c that can result in Crash/DoS - it is unknown if RCE is possible. This attack appear to be...

CVE-2018-1000880

libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards release v3.2.0 onwards contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archivereadsupportformatwarc.c, warcread that can result in DoS - quasi-infinite run time and disk usage from ti...

CVE-2018-1000879

libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards release v3.3.0 onwards contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archiveacl.c, archiveaclfromtextl that can result in Crash/DoS. This attack appear to be exploitable via the vict...

Fedora 29 : libarchive (2018-7734354526)

latest upstream release, fixes several CVE security issues Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Fedora 28 : libarchive (2018-20c24949c0)

latest upstream release, fixes several CVE issues Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

SUSE SLED15 / SLES15 Security Update : libarchive (SUSE-SU-2018:3571-1)

This update for libarchive fixes the following issues : CVE-2017-14501: An out-of-bounds read flaw existed in parsefileinfo in archivereadsupportformatiso9660.c when extracting a specially crafted iso9660 iso file, related to archivereadformatiso9660readheader. bsc1059139 CVE-2017-14502: readhead...

Debian DSA-4360-1 : libarchive - security update

Multiple security issues were found in libarchive, a multi-format archive and compression library: Processing malformed RAR archives could result in denial of service or the execution of arbitrary code and malformed WARC, LHarc, ISO, Xar or CAB archives could result in denial of service. C Tenabl...

[SECURITY] [DSA 4360-1] libarchive security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4360-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 27, 2018 https://www.debian.org/security/faq -...