Veracode Vulnerability DatabaseVERACODE:22010Denial Of Service (DoS)
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:N/A:P
libarchive.so is vulnerable to denial of service. The archive_wstring_append_from_mbs in archive_string.c allows an attacker to crash the application using a malicious archive due to an out-of-bounds read because of an incorrect mbrtowc or mbtowc call.
References
github.com/libarchive/libarchive/commit/22b1db9d46654afc6f0c28f90af8cdc84a199f41
github.com/libarchive/libarchive/issues/1276
lists.debian.org/debian-lts-announce/2022/04/msg00020.html
lists.debian.org/debian-lts-announce/2022/11/msg00030.html
lists.fedoraproject.org/archives/list/[email protected]/message/RHFV25AVTASTWZRF3KTSL357AQ6TYHM4/
usn.ubuntu.com/4293-1/
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:N/A:P