PT-2018-10613 · Lrzip+1 · Long Range Zip+1

Twi1Ight · Published 2018-05-26 · Updated 2022-10-06 · CVE-2018-11496

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Long Range Zip (aka lrzip) version 0.631

Description The issue is related to a use-after-free in the read stream function in stream.c, caused by the lack of certain size validation in the decompress file function in lrzip.c.

Recommendations For Long Range Zip (aka lrzip) version 0.631, consider updating to a newer version that addresses the size validation issue in the decompress file function. As a temporary workaround, restrict the use of the decompress file function until a patch is available.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2018-11496

DLA-2725-1

USN-5171-1

USN-5171-2

Affected Products

Long Range Zip

Ubuntu

References · 27

• 🔥 https://github.com/ckolivas/lrzip/issues/96 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-11496 · Security Note
• https://osv.dev/vulnerability/USN-5171-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5171-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-11496 · Security Note
• https://osv.dev/vulnerability/DLA-2725-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10685 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-8844 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5171-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5171-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-11496 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5786 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-11496 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9928 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-9058 · Vendor Advisory