Red Hat Security AdvisoryRHSA-2019:2298
libarchive security update
Released 2019-08-06 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) libarchive-3.1.2-12.el7
- Red Hat Enterprise Linux Client Optional (v. 7) bsdcpio-3.1.2-12.el7, bsdtar-3.1.2-12.el7, libarchive-devel-3.1.2-12.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) libarchive-3.1.2-12.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) bsdcpio-3.1.2-12.el7, bsdtar-3.1.2-12.el7, libarchive-devel-3.1.2-12.el7
- Red Hat Enterprise Linux Server (v. 7) libarchive-3.1.2-12.el7, libarchive-3.1.2-12.el7.ppc
- Red Hat Enterprise Linux Server Optional (v. 7) bsdcpio-3.1.2-12.el7, bsdtar-3.1.2-12.el7, libarchive-devel-3.1.2-12.el7 +1
- Red Hat Enterprise Linux Workstation (v. 7) libarchive-3.1.2-12.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) bsdcpio-3.1.2-12.el7, bsdtar-3.1.2-12.el7, libarchive-devel-3.1.2-12.el7
Fixes 5 records
Priority MEDIUM 45
libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c that can…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.04449 · Published 2018-12-20 · Fixed CWE-416
Priority MEDIUM 45
libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.04575 · Published 2018-12-20 · Fixed CWE-415
Priority LOW 35
libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archive_read…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.03196 · Published 2019-02-04 · Partial fix CWE-835
Priority LOW 35
libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_b…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.03407 · Published 2019-02-04 · Fixed CWE-125
Priority LOW 33
libarchive 3.3.2 suffers from an out-of-bounds read within lha_read_data_none() in archive_read_support_format_lha.c when extracting a specially crafted lha archive, related to lha_crc16.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01956 · Published 2017-09-17 · Partial fix CWE-125
THREATIST.IORead the docs