PT-2019-12323 · Libarchive+1 · Libarchive+1

Rohanpadhye · Published 2019-04-23 · Updated 2020-12-08 · CVE-2019-11463

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libarchive version 3.3.4-dev

Description A memory leak in the archive read format zip cleanup function in archive read support format zip.c allows remote attackers to cause a denial of service via a crafted ZIP file because of a HAVE LZMA H typo. This issue only affects users who downloaded the development code from GitHub, while users of the product's official releases are unaffected.

Recommendations For libarchive version 3.3.4-dev, consider avoiding the use of the archive read format zip cleanup function until a fix is available. As a temporary workaround, restrict the handling of ZIP files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALT-PU-2019-2522

ALT-PU-2019-3125

CVE-2019-11463

Affected Products

Alt Linux

Libarchive

References · 6

• 🔥 https://github.com/libarchive/libarchive/issues/1165 · Exploit
• https://github.com/libarchive/libarchive/commit/ba641f73f3d758d9032b3f0e5597a9c6e593a505 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-11463 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11463 · Vendor Advisory
• https://access.redhat.com/security/cve/cve-2019-11463 · Note
• https://t.me/cvenotify/6744 · Telegram Post