Bugzilla – Bug 1120653
VUL-1: CVE-2018-1000877: libarchive: double free vulnerability in RAR decoder
Last modified: 2020-05-12 18:32:08 UTC
CVE-2018-1000877 libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar->lzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000877 http://www.debian.org/security/2018/dsa-4360 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000877 https://lists.debian.org/debian-lts-announce/2018/12/msg00011.html https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909 https://github.com/libarchive/libarchive/pull/1105 https://github.com/libarchive/libarchive/pull/1105/commits/021efa522ad729ff0f5806c4ce53e4a6cc1daa31
got fixed by karol
SUSE-SU-2019:0831-1: An update that fixes 6 vulnerabilities is now available. Category: security (moderate) Bug References: 1120653,1120654,1120656,1120659,1124341,1124342 CVE References: CVE-2018-1000877,CVE-2018-1000878,CVE-2018-1000879,CVE-2018-1000880,CVE-2019-1000019,CVE-2019-1000020 Sources used: SUSE Linux Enterprise Module for Development Tools 15 (src): libarchive-3.3.2-3.8.4 SUSE Linux Enterprise Module for Basesystem 15 (src): libarchive-3.3.2-3.8.4 *** NOTE: This information is not intended to be used for external communication, because this may only be a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:3093-1: An update that fixes 5 vulnerabilities is now available. Category: security (moderate) Bug References: 1120653,1120654,1124341,1124342,1155079 CVE References: CVE-2018-1000877,CVE-2018-1000878,CVE-2019-1000019,CVE-2019-1000020,CVE-2019-18408 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): libarchive-3.3.2-3.11.1 SUSE Linux Enterprise Module for Development Tools 15-SP1 (src): libarchive-3.3.2-3.11.1 SUSE Linux Enterprise Module for Development Tools 15 (src): libarchive-3.3.2-3.11.1 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): libarchive-3.3.2-3.11.1 SUSE Linux Enterprise Module for Basesystem 15 (src): libarchive-3.3.2-3.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:3092-1: An update that fixes 10 vulnerabilities is now available. Category: security (moderate) Bug References: 1032089,1037008,1037009,1059134,1059139,1120653,1120654,1124341,1124342,1155079 CVE References: CVE-2016-10209,CVE-2016-10349,CVE-2016-10350,CVE-2017-14501,CVE-2017-14502,CVE-2018-1000877,CVE-2018-1000878,CVE-2019-1000019,CVE-2019-1000020,CVE-2019-18408 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP5 (src): libarchive-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): libarchive-3.1.2-26.6.1 SUSE Linux Enterprise Server 12-SP5 (src): libarchive-3.1.2-26.6.1 SUSE Linux Enterprise Server 12-SP4 (src): libarchive-3.1.2-26.6.1 SUSE Linux Enterprise Desktop 12-SP4 (src): libarchive-3.1.2-26.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:2615-1: An update that fixes 5 vulnerabilities is now available. Category: security (moderate) Bug References: 1120653,1120654,1124341,1124342,1155079 CVE References: CVE-2018-1000877,CVE-2018-1000878,CVE-2019-1000019,CVE-2019-1000020,CVE-2019-18408 Sources used: openSUSE Leap 15.0 (src): libarchive-3.3.2-lp150.10.1
openSUSE-SU-2019:2632-1: An update that fixes 5 vulnerabilities is now available. Category: security (moderate) Bug References: 1120653,1120654,1124341,1124342,1155079 CVE References: CVE-2018-1000877,CVE-2018-1000878,CVE-2019-1000019,CVE-2019-1000020,CVE-2019-18408 Sources used: openSUSE Leap 15.1 (src): libarchive-3.3.2-lp151.5.3.1
Done