PT-2018-2640 · Libarchive+5 · Libarchive+5
Published
2018-11-20
·
Updated
2024-06-15
·
CVE-2018-1000878
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libarchive versions 3.1.0 and later
Description
The issue is related to a CWE-416: Use After Free vulnerability in the RAR decoder of the libarchive library, specifically in the file libarchive/archive read support format rar.c. This vulnerability can result in a Crash or Denial of Service (DoS) and potentially allow for remote code execution (RCE), although the possibility of RCE is unknown. The attack appears to be exploitable if a victim opens a specially crafted RAR archive.
Recommendations
For libarchive versions 3.1.0 and later, consider avoiding the use of the RAR decoder until a patch is available. As a temporary workaround, restrict access to the vulnerable
libarchive/archive read support format rar.c file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
RCE
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Libarchive