PT-2019-3960 · Libarchive+4 · Libarchive+4

Published 2019-05-10 · Updated 2024-06-15 · CVE-2019-18408

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libarchive versions prior to 3.4.0

Description The issue is related to a use-after-free bug in the archive read format rar read data function of the archive read support format rar.c module in the libarchive library. This bug can be exploited by a remote attacker to cause a denial of service, particularly in situations involving a failed archive and the Ppmd7 DecodeSymbol function.

Recommendations For versions prior to 3.4.0, update to version 3.4.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the archive read format rar read data function until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2019-04476

CESA-2020_0203

CESA-2020_0271

CVE-2019-18408

DLA-1971-1

DSA-4557-1

OPENSUSE-SU-2019:2615-1

OPENSUSE-SU-2019:2632-1

OPENSUSE-SU-2019_2615-1

OPENSUSE-SU-2019_2632-1

OPENSUSE-SU-2024:10925-1

RHSA-2020:0203

RHSA-2020:0246

RHSA-2020:0271

RHSA-2020_0203

RHSA-2020_0271

SUSE-RU-2021:2757-1

SUSE-SU-2019:3092-1

SUSE-SU-2019:3093-1

USN-4169-1

Affected Products

Centos

Red Hat

Suse

Ubuntu

Libarchive

References · 78

• https://github.com/libarchive/libarchive/commit/b8592ecba2f9e451e1f5cb7ab6dcee8b8e7b3f60 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18408 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2021:2757-1 · Vendor Advisory
• https://usn.ubuntu.com/4169-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-18408 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-18408 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se15-bulletin-20201201SE15 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LZ4VJGTCYEJSDLOEWUUFG6TM4SUPFSY · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-0203.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-18408 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2632-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0246 · Vendor Advisory
• https://debian.org/security/2019/dsa-4557 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6LZ4VJGTCYEJSDLOEWUUFG6TM4SUPFSY · Vendor Advisory