PT-2019-12323 · Libarchive+1 · Libarchive+1

Rohanpadhye · Publicado 2019-04-23 · Atualizado 2020-12-08 · CVE-2019-11463

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libarchive version 3.3.4-dev

Description A memory leak in the archive read format zip cleanup function in archive read support format zip.c allows remote attackers to cause a denial of service via a crafted ZIP file because of a HAVE LZMA H typo. This issue only affects users who downloaded the development code from GitHub, while users of the product's official releases are unaffected.

Recommendations For libarchive version 3.3.4-dev, consider avoiding the use of the archive read format zip cleanup function until a fix is available. As a temporary workaround, restrict the handling of ZIP files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Leak

Enumeração de Fraquezas

CWE-401

Identificadores relacionados

ALT-PU-2019-2522

ALT-PU-2019-3125

CVE-2019-11463

Produtos afetados

Alt Linux

Libarchive

Referências · 6

• 🔥 https://github.com/libarchive/libarchive/issues/1165 · Exploit
• https://github.com/libarchive/libarchive/commit/ba641f73f3d758d9032b3f0e5597a9c6e593a505 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2019-11463 · Nota de Segurança
• https://access.redhat.com/security/cve/cve-2019-11463 · Nota
• https://osv.dev/vulnerability/CVE-2019-11463 · Aviso do Fabricante
• https://t.me/cvenotify/6744 · Publicação no Telegram