PT-2018-10613 · Lrzip+1 · Long Range Zip+1

Twi1Ight · Publicado 2018-05-26 · Atualizado 2022-10-06 · CVE-2018-11496

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Long Range Zip (aka lrzip) version 0.631

Description The issue is related to a use-after-free in the read stream function in stream.c, caused by the lack of certain size validation in the decompress file function in lrzip.c.

Recommendations For Long Range Zip (aka lrzip) version 0.631, consider updating to a newer version that addresses the size validation issue in the decompress file function. As a temporary workaround, restrict the use of the decompress file function until a patch is available.

Exploit

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2018-11496

DLA-2725-1

USN-5171-1

USN-5171-2

Produtos afetados

Long Range Zip

Ubuntu

Referências · 27

• 🔥 https://github.com/ckolivas/lrzip/issues/96 · Exploit
• https://github.com/ckolivas/lrzip/commit/907b66b8cb4ba7384abf8d82f09204b127d328bd · Nota
• https://github.com/ckolivas/lrzip/commit/a81248e47d276cf59b8c7e22558e2b5035e87b33 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-11496 · Nota de Segurança
• https://osv.dev/vulnerability/USN-5171-2 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-5171-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-11496 · Nota de Segurança
• https://t.me/cvenotify/35644 · Publicação no Telegram
• https://osv.dev/vulnerability/DLA-2725-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-10685 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-8844 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-5171-1 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2021/08/msg00001.html · Nota
• https://ubuntu.com/security/notices/USN-5171-2 · Aviso do Fabricante
• https://t.me/cvenotify/18421 · Publicação no Telegram