Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2018-1000880 (GCVE-0-2018-1000880)
Vulnerability from cvelistv5
Published
2018-12-20 17:00
Modified
2024-08-05 12:47
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T12:47:57.393Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "USN-3859-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "https://usn.ubuntu.com/3859-1/" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909" }, { "name": "DSA-4360", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "https://www.debian.org/security/2018/dsa-4360" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/libarchive/libarchive/pull/1105" }, { "name": "106324", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/106324" }, { "name": "FEDORA-2019-0233ec0ff3", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/" }, { "name": "FEDORA-2019-fbe83d0e32", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/" }, { "name": "FEDORA-2019-c595a93536", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/" }, { "name": "openSUSE-SU-2019:1196", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "dateAssigned": "2018-12-19T00:00:00", "datePublic": "2018-12-20T00:00:00", "descriptions": [ { "lang": "en", "value": "libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2019-04-12T12:06:02", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "name": "USN-3859-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "https://usn.ubuntu.com/3859-1/" }, { "tags": [ "x_refsource_MISC" ], "url": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909" }, { "name": "DSA-4360", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "https://www.debian.org/security/2018/dsa-4360" }, { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680" }, { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/libarchive/libarchive/pull/1105" }, { "name": "106324", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/106324" }, { "name": "FEDORA-2019-0233ec0ff3", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/" }, { "name": "FEDORA-2019-fbe83d0e32", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/" }, { "name": "FEDORA-2019-c595a93536", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/" }, { "name": "openSUSE-SU-2019:1196", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "DATE_ASSIGNED": "2018-12-19T20:52:45.248774", "DATE_REQUESTED": "2018-12-13T09:53:50", "ID": "CVE-2018-1000880", "REQUESTER": "dja@axtens.net", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "USN-3859-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/3859-1/" }, { "name": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909", "refsource": "MISC", "url": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909" }, { "name": "DSA-4360", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2018/dsa-4360" }, { "name": "https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680", "refsource": "MISC", "url": "https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680" }, { "name": "https://github.com/libarchive/libarchive/pull/1105", "refsource": "MISC", "url": "https://github.com/libarchive/libarchive/pull/1105" }, { "name": "106324", "refsource": "BID", "url": "http://www.securityfocus.com/bid/106324" }, { "name": "FEDORA-2019-0233ec0ff3", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/" }, { "name": "FEDORA-2019-fbe83d0e32", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/" }, { "name": "FEDORA-2019-c595a93536", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/" }, { "name": "openSUSE-SU-2019:1196", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-1000880", "datePublished": "2018-12-20T17:00:00", "dateReserved": "2018-12-13T00:00:00", "dateUpdated": "2024-08-05T12:47:57.393Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2018-1000880\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2018-12-20T17:29:01.300\",\"lastModified\":\"2024-11-21T03:40:34.317\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.\"},{\"lang\":\"es\",\"value\":\"libarchive, con el commit con ID 9693801580c0cf7c70e862d305270a16b52826a7 y siguientes (desde la v3.2.0) contiene una vulnerabilidad CWE-20: validaci\u00f3n de entradas incorrecta en el analizador WARC (), en _warc_read(), que puede resultar en una denegaci\u00f3n de servicio (DoS) en tiempo de ejecuci\u00f3n casi infinito y uso de disco desde un archivo muy peque\u00f1o. El ataque parece ser explotable si una v\u00edctima abre un archivo WARC especialmente manipulado.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2.0\",\"versionEndExcluding\":\"3.4.0\",\"matchCriteriaId\":\"9AABA23E-DB9A-4138-A4DF-BE21AA3EE048\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B5A6F2F3-4894-4392-8296-3B8DD2679084\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07C312A0-CD2C-4B9C-B064-6409B25C278F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D100F7CE-FC64-4CC6-852A-6136D72DA419\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"97A4B8DF-58DA-4AB6-A1F9-331B36409BA3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1E78106-58E6-4D59-990F-75DA575BFAD9\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/106324\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/libarchive/libarchive/pull/1105\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://usn.ubuntu.com/3859-1/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2018/dsa-4360\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/106324\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/libarchive/libarchive/pull/1105\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://usn.ubuntu.com/3859-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2018/dsa-4360\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
opensuse-su-2019:1196-1
Vulnerability from csaf_opensuse
Published
2019-04-12 07:23
Modified
2019-04-12 07:23
Summary
Security update for libarchive
Notes
Title of the patch
Security update for libarchive
Description of the patch
This update for libarchive fixes the following issues:
Security issues fixed:
- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653)
- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654)
- CVE-2018-1000879: Fixed a NULL Pointer Dereference vulnerability in ACL parser (bsc#1120656)
- CVE-2018-1000880: Fixed an Improper Input Validation vulnerability in WARC parser (bsc#1120659)
- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341)
- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342)
This update was imported from the SUSE:SLE-15:Update update project.
Patchnames
openSUSE-2019-1196
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for libarchive", "title": "Title of the patch" }, { "category": "description", "text": "This update for libarchive fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653)\n- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654)\n- CVE-2018-1000879: Fixed a NULL Pointer Dereference vulnerability in ACL parser (bsc#1120656)\n- CVE-2018-1000880: Fixed an Improper Input Validation vulnerability in WARC parser (bsc#1120659)\n- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341) \n- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342)\n\nThis update was imported from the SUSE:SLE-15:Update update project.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-2019-1196", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2019_1196-1.json" }, { "category": "self", "summary": "URL for openSUSE-SU-2019:1196-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TIJ7ZTUCNAB4P5RGZHQDF4OC3WRSBWO4/#TIJ7ZTUCNAB4P5RGZHQDF4OC3WRSBWO4" }, { "category": "self", "summary": "E-Mail link for openSUSE-SU-2019:1196-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TIJ7ZTUCNAB4P5RGZHQDF4OC3WRSBWO4/#TIJ7ZTUCNAB4P5RGZHQDF4OC3WRSBWO4" }, { "category": "self", "summary": "SUSE Bug 1120653", "url": "https://bugzilla.suse.com/1120653" }, { "category": "self", "summary": "SUSE Bug 1120654", "url": "https://bugzilla.suse.com/1120654" }, { "category": "self", "summary": "SUSE Bug 1120656", "url": "https://bugzilla.suse.com/1120656" }, { "category": "self", "summary": "SUSE Bug 1120659", "url": "https://bugzilla.suse.com/1120659" }, { "category": "self", "summary": "SUSE Bug 1124341", "url": "https://bugzilla.suse.com/1124341" }, { "category": "self", "summary": "SUSE Bug 1124342", "url": "https://bugzilla.suse.com/1124342" }, { "category": "self", "summary": "SUSE CVE CVE-2018-1000877 page", "url": "https://www.suse.com/security/cve/CVE-2018-1000877/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-1000878 page", "url": "https://www.suse.com/security/cve/CVE-2018-1000878/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-1000879 page", "url": "https://www.suse.com/security/cve/CVE-2018-1000879/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-1000880 page", "url": "https://www.suse.com/security/cve/CVE-2018-1000880/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-1000019 page", "url": "https://www.suse.com/security/cve/CVE-2019-1000019/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-1000020 page", "url": "https://www.suse.com/security/cve/CVE-2019-1000020/" } ], "title": "Security update for libarchive", "tracking": { "current_release_date": "2019-04-12T07:23:10Z", "generator": { "date": "2019-04-12T07:23:10Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2019:1196-1", "initial_release_date": "2019-04-12T07:23:10Z", "revision_history": [ { "date": "2019-04-12T07:23:10Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "bsdtar-3.3.2-lp150.7.1.i586", "product": { "name": "bsdtar-3.3.2-lp150.7.1.i586", "product_id": "bsdtar-3.3.2-lp150.7.1.i586" } }, { "category": "product_version", "name": "libarchive-devel-3.3.2-lp150.7.1.i586", "product": { "name": "libarchive-devel-3.3.2-lp150.7.1.i586", "product_id": "libarchive-devel-3.3.2-lp150.7.1.i586" } }, { "category": "product_version", "name": "libarchive13-3.3.2-lp150.7.1.i586", "product": { "name": "libarchive13-3.3.2-lp150.7.1.i586", "product_id": "libarchive13-3.3.2-lp150.7.1.i586" } } ], "category": "architecture", "name": "i586" }, { "branches": [ { "category": "product_version", "name": "bsdtar-3.3.2-lp150.7.1.x86_64", "product": { "name": "bsdtar-3.3.2-lp150.7.1.x86_64", "product_id": "bsdtar-3.3.2-lp150.7.1.x86_64" } }, { "category": "product_version", "name": "libarchive-devel-3.3.2-lp150.7.1.x86_64", "product": { "name": "libarchive-devel-3.3.2-lp150.7.1.x86_64", "product_id": "libarchive-devel-3.3.2-lp150.7.1.x86_64" } }, { "category": "product_version", "name": "libarchive13-3.3.2-lp150.7.1.x86_64", "product": { "name": "libarchive13-3.3.2-lp150.7.1.x86_64", "product_id": "libarchive13-3.3.2-lp150.7.1.x86_64" } }, { "category": "product_version", "name": "libarchive13-32bit-3.3.2-lp150.7.1.x86_64", "product": { "name": "libarchive13-32bit-3.3.2-lp150.7.1.x86_64", "product_id": "libarchive13-32bit-3.3.2-lp150.7.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Leap 15.0", "product": { "name": "openSUSE Leap 15.0", "product_id": "openSUSE Leap 15.0", "product_identification_helper": { "cpe": "cpe:/o:opensuse:leap:15.0" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "bsdtar-3.3.2-lp150.7.1.i586 as component of openSUSE Leap 15.0", "product_id": "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586" }, "product_reference": "bsdtar-3.3.2-lp150.7.1.i586", "relates_to_product_reference": "openSUSE Leap 15.0" }, { "category": "default_component_of", "full_product_name": { "name": "bsdtar-3.3.2-lp150.7.1.x86_64 as component of openSUSE Leap 15.0", "product_id": "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64" }, "product_reference": "bsdtar-3.3.2-lp150.7.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.0" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-3.3.2-lp150.7.1.i586 as component of openSUSE Leap 15.0", "product_id": "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586" }, "product_reference": "libarchive-devel-3.3.2-lp150.7.1.i586", "relates_to_product_reference": "openSUSE Leap 15.0" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-3.3.2-lp150.7.1.x86_64 as component of openSUSE Leap 15.0", "product_id": "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64" }, "product_reference": "libarchive-devel-3.3.2-lp150.7.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.0" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-3.3.2-lp150.7.1.i586 as component of openSUSE Leap 15.0", "product_id": "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586" }, "product_reference": "libarchive13-3.3.2-lp150.7.1.i586", "relates_to_product_reference": "openSUSE Leap 15.0" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-3.3.2-lp150.7.1.x86_64 as component of openSUSE Leap 15.0", "product_id": "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64" }, "product_reference": "libarchive13-3.3.2-lp150.7.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.0" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-32bit-3.3.2-lp150.7.1.x86_64 as component of openSUSE Leap 15.0", "product_id": "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" }, "product_reference": "libarchive13-32bit-3.3.2-lp150.7.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.0" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-1000877", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-1000877" } ], "notes": [ { "category": "general", "text": "libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar-\u003elzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-1000877", "url": "https://www.suse.com/security/cve/CVE-2018-1000877" }, { "category": "external", "summary": "SUSE Bug 1120653 for CVE-2018-1000877", "url": "https://bugzilla.suse.com/1120653" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-04-12T07:23:10Z", "details": "low" } ], "title": "CVE-2018-1000877" }, { "cve": "CVE-2018-1000878", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-1000878" } ], "notes": [ { "category": "general", "text": "libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c that can result in Crash/DoS - it is unknown if RCE is possible. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-1000878", "url": "https://www.suse.com/security/cve/CVE-2018-1000878" }, { "category": "external", "summary": "SUSE Bug 1120654 for CVE-2018-1000878", "url": "https://bugzilla.suse.com/1120654" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-04-12T07:23:10Z", "details": "moderate" } ], "title": "CVE-2018-1000878" }, { "cve": "CVE-2018-1000879", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-1000879" } ], "notes": [ { "category": "general", "text": "libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted archive file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-1000879", "url": "https://www.suse.com/security/cve/CVE-2018-1000879" }, { "category": "external", "summary": "SUSE Bug 1120656 for CVE-2018-1000879", "url": "https://bugzilla.suse.com/1120656" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-04-12T07:23:10Z", "details": "low" } ], "title": "CVE-2018-1000879" }, { "cve": "CVE-2018-1000880", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-1000880" } ], "notes": [ { "category": "general", "text": "libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-1000880", "url": "https://www.suse.com/security/cve/CVE-2018-1000880" }, { "category": "external", "summary": "SUSE Bug 1120659 for CVE-2018-1000880", "url": "https://bugzilla.suse.com/1120659" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-04-12T07:23:10Z", "details": "low" } ], "title": "CVE-2018-1000880" }, { "cve": "CVE-2019-1000019", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-1000019" } ], "notes": [ { "category": "general", "text": "libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-1000019", "url": "https://www.suse.com/security/cve/CVE-2019-1000019" }, { "category": "external", "summary": "SUSE Bug 1124341 for CVE-2019-1000019", "url": "https://bugzilla.suse.com/1124341" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-04-12T07:23:10Z", "details": "low" } ], "title": "CVE-2019-1000019" }, { "cve": "CVE-2019-1000020", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-1000020" } ], "notes": [ { "category": "general", "text": "libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-1000020", "url": "https://www.suse.com/security/cve/CVE-2019-1000020" }, { "category": "external", "summary": "SUSE Bug 1124342 for CVE-2019-1000020", "url": "https://bugzilla.suse.com/1124342" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:bsdtar-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive-devel-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.i586", "openSUSE Leap 15.0:libarchive13-3.3.2-lp150.7.1.x86_64", "openSUSE Leap 15.0:libarchive13-32bit-3.3.2-lp150.7.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-04-12T07:23:10Z", "details": "low" } ], "title": "CVE-2019-1000020" } ] }
opensuse-su-2024:10925-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
bsdtar-3.5.1-1.5 on GA media
Notes
Title of the patch
bsdtar-3.5.1-1.5 on GA media
Description of the patch
These are all security issues fixed in the bsdtar-3.5.1-1.5 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-10925
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "bsdtar-3.5.1-1.5 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the bsdtar-3.5.1-1.5 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-10925", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10925-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2006-5680 page", "url": "https://www.suse.com/security/cve/CVE-2006-5680/" }, { "category": "self", "summary": "SUSE CVE CVE-2007-3641 page", "url": "https://www.suse.com/security/cve/CVE-2007-3641/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-14166 page", "url": "https://www.suse.com/security/cve/CVE-2017-14166/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-14501 page", "url": "https://www.suse.com/security/cve/CVE-2017-14501/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-1000877 page", "url": "https://www.suse.com/security/cve/CVE-2018-1000877/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-1000878 page", "url": "https://www.suse.com/security/cve/CVE-2018-1000878/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-1000879 page", "url": "https://www.suse.com/security/cve/CVE-2018-1000879/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-1000880 page", "url": "https://www.suse.com/security/cve/CVE-2018-1000880/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-1000019 page", "url": "https://www.suse.com/security/cve/CVE-2019-1000019/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-1000020 page", "url": "https://www.suse.com/security/cve/CVE-2019-1000020/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-18408 page", "url": "https://www.suse.com/security/cve/CVE-2019-18408/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-19221 page", "url": "https://www.suse.com/security/cve/CVE-2019-19221/" } ], "title": "bsdtar-3.5.1-1.5 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:10925-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "bsdtar-3.5.1-1.5.aarch64", "product": { "name": "bsdtar-3.5.1-1.5.aarch64", "product_id": "bsdtar-3.5.1-1.5.aarch64" } }, { "category": "product_version", "name": "libarchive-devel-3.5.1-1.5.aarch64", "product": { "name": "libarchive-devel-3.5.1-1.5.aarch64", "product_id": "libarchive-devel-3.5.1-1.5.aarch64" } }, { "category": "product_version", "name": "libarchive13-3.5.1-1.5.aarch64", "product": { "name": "libarchive13-3.5.1-1.5.aarch64", "product_id": "libarchive13-3.5.1-1.5.aarch64" } }, { "category": "product_version", "name": "libarchive13-32bit-3.5.1-1.5.aarch64", "product": { "name": "libarchive13-32bit-3.5.1-1.5.aarch64", "product_id": "libarchive13-32bit-3.5.1-1.5.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "bsdtar-3.5.1-1.5.ppc64le", "product": { "name": "bsdtar-3.5.1-1.5.ppc64le", "product_id": "bsdtar-3.5.1-1.5.ppc64le" } }, { "category": "product_version", "name": "libarchive-devel-3.5.1-1.5.ppc64le", "product": { "name": "libarchive-devel-3.5.1-1.5.ppc64le", "product_id": "libarchive-devel-3.5.1-1.5.ppc64le" } }, { "category": "product_version", "name": "libarchive13-3.5.1-1.5.ppc64le", "product": { "name": "libarchive13-3.5.1-1.5.ppc64le", "product_id": "libarchive13-3.5.1-1.5.ppc64le" } }, { "category": "product_version", "name": "libarchive13-32bit-3.5.1-1.5.ppc64le", "product": { "name": "libarchive13-32bit-3.5.1-1.5.ppc64le", "product_id": "libarchive13-32bit-3.5.1-1.5.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "bsdtar-3.5.1-1.5.s390x", "product": { "name": "bsdtar-3.5.1-1.5.s390x", "product_id": "bsdtar-3.5.1-1.5.s390x" } }, { "category": "product_version", "name": "libarchive-devel-3.5.1-1.5.s390x", "product": { "name": "libarchive-devel-3.5.1-1.5.s390x", "product_id": "libarchive-devel-3.5.1-1.5.s390x" } }, { "category": "product_version", "name": "libarchive13-3.5.1-1.5.s390x", "product": { "name": "libarchive13-3.5.1-1.5.s390x", "product_id": "libarchive13-3.5.1-1.5.s390x" } }, { "category": "product_version", "name": "libarchive13-32bit-3.5.1-1.5.s390x", "product": { "name": "libarchive13-32bit-3.5.1-1.5.s390x", "product_id": "libarchive13-32bit-3.5.1-1.5.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "bsdtar-3.5.1-1.5.x86_64", "product": { "name": "bsdtar-3.5.1-1.5.x86_64", "product_id": "bsdtar-3.5.1-1.5.x86_64" } }, { "category": "product_version", "name": "libarchive-devel-3.5.1-1.5.x86_64", "product": { "name": "libarchive-devel-3.5.1-1.5.x86_64", "product_id": "libarchive-devel-3.5.1-1.5.x86_64" } }, { "category": "product_version", "name": "libarchive13-3.5.1-1.5.x86_64", "product": { "name": "libarchive13-3.5.1-1.5.x86_64", "product_id": "libarchive13-3.5.1-1.5.x86_64" } }, { "category": "product_version", "name": "libarchive13-32bit-3.5.1-1.5.x86_64", "product": { "name": "libarchive13-32bit-3.5.1-1.5.x86_64", "product_id": "libarchive13-32bit-3.5.1-1.5.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "bsdtar-3.5.1-1.5.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64" }, "product_reference": "bsdtar-3.5.1-1.5.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "bsdtar-3.5.1-1.5.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le" }, "product_reference": "bsdtar-3.5.1-1.5.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "bsdtar-3.5.1-1.5.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x" }, "product_reference": "bsdtar-3.5.1-1.5.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "bsdtar-3.5.1-1.5.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64" }, "product_reference": "bsdtar-3.5.1-1.5.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-3.5.1-1.5.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64" }, "product_reference": "libarchive-devel-3.5.1-1.5.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-3.5.1-1.5.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le" }, "product_reference": "libarchive-devel-3.5.1-1.5.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-3.5.1-1.5.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x" }, "product_reference": "libarchive-devel-3.5.1-1.5.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-3.5.1-1.5.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64" }, "product_reference": "libarchive-devel-3.5.1-1.5.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-3.5.1-1.5.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64" }, "product_reference": "libarchive13-3.5.1-1.5.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-3.5.1-1.5.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le" }, "product_reference": "libarchive13-3.5.1-1.5.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-3.5.1-1.5.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x" }, "product_reference": "libarchive13-3.5.1-1.5.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-3.5.1-1.5.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64" }, "product_reference": "libarchive13-3.5.1-1.5.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-32bit-3.5.1-1.5.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64" }, "product_reference": "libarchive13-32bit-3.5.1-1.5.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-32bit-3.5.1-1.5.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le" }, "product_reference": "libarchive13-32bit-3.5.1-1.5.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-32bit-3.5.1-1.5.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x" }, "product_reference": "libarchive13-32bit-3.5.1-1.5.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-32bit-3.5.1-1.5.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" }, "product_reference": "libarchive13-32bit-3.5.1-1.5.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2006-5680", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2006-5680" } ], "notes": [ { "category": "general", "text": "The libarchive library in FreeBSD 6-STABLE after 2006-09-05 and before 2006-11-08 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive that causes libarchive to skip a region past the actual end of the archive, which triggers an infinite loop that attempts to read more data.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2006-5680", "url": "https://www.suse.com/security/cve/CVE-2006-5680" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2006-5680" }, { "cve": "CVE-2007-3641", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2007-3641" } ], "notes": [ { "category": "general", "text": "archive_read_support_format_tar.c in libarchive before 2.2.4 does not properly compute the length of a certain buffer when processing a malformed pax extension header, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PAX or (2) TAR archive that triggers a buffer overflow.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2007-3641", "url": "https://www.suse.com/security/cve/CVE-2007-3641" }, { "category": "external", "summary": "SUSE Bug 291358 for CVE-2007-3641", "url": "https://bugzilla.suse.com/291358" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2007-3641" }, { "cve": "CVE-2017-14166", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-14166" } ], "notes": [ { "category": "general", "text": "libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a crafted xar archive, related to the mishandling of empty strings in the atol8 function in archive_read_support_format_xar.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-14166", "url": "https://www.suse.com/security/cve/CVE-2017-14166" }, { "category": "external", "summary": "SUSE Bug 1057514 for CVE-2017-14166", "url": "https://bugzilla.suse.com/1057514" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-14166" }, { "cve": "CVE-2017-14501", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-14501" } ], "notes": [ { "category": "general", "text": "An out-of-bounds read flaw exists in parse_file_info in archive_read_support_format_iso9660.c in libarchive 3.3.2 when extracting a specially crafted iso9660 iso file, related to archive_read_format_iso9660_read_header.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-14501", "url": "https://www.suse.com/security/cve/CVE-2017-14501" }, { "category": "external", "summary": "SUSE Bug 1059139 for CVE-2017-14501", "url": "https://bugzilla.suse.com/1059139" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2017-14501" }, { "cve": "CVE-2018-1000877", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-1000877" } ], "notes": [ { "category": "general", "text": "libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar-\u003elzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-1000877", "url": "https://www.suse.com/security/cve/CVE-2018-1000877" }, { "category": "external", "summary": "SUSE Bug 1120653 for CVE-2018-1000877", "url": "https://bugzilla.suse.com/1120653" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2018-1000877" }, { "cve": "CVE-2018-1000878", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-1000878" } ], "notes": [ { "category": "general", "text": "libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c that can result in Crash/DoS - it is unknown if RCE is possible. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-1000878", "url": "https://www.suse.com/security/cve/CVE-2018-1000878" }, { "category": "external", "summary": "SUSE Bug 1120654 for CVE-2018-1000878", "url": "https://bugzilla.suse.com/1120654" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-1000878" }, { "cve": "CVE-2018-1000879", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-1000879" } ], "notes": [ { "category": "general", "text": "libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted archive file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-1000879", "url": "https://www.suse.com/security/cve/CVE-2018-1000879" }, { "category": "external", "summary": "SUSE Bug 1120656 for CVE-2018-1000879", "url": "https://bugzilla.suse.com/1120656" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2018-1000879" }, { "cve": "CVE-2018-1000880", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-1000880" } ], "notes": [ { "category": "general", "text": "libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-1000880", "url": "https://www.suse.com/security/cve/CVE-2018-1000880" }, { "category": "external", "summary": "SUSE Bug 1120659 for CVE-2018-1000880", "url": "https://bugzilla.suse.com/1120659" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2018-1000880" }, { "cve": "CVE-2019-1000019", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-1000019" } ], "notes": [ { "category": "general", "text": "libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-1000019", "url": "https://www.suse.com/security/cve/CVE-2019-1000019" }, { "category": "external", "summary": "SUSE Bug 1124341 for CVE-2019-1000019", "url": "https://bugzilla.suse.com/1124341" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2019-1000019" }, { "cve": "CVE-2019-1000020", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-1000020" } ], "notes": [ { "category": "general", "text": "libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-1000020", "url": "https://www.suse.com/security/cve/CVE-2019-1000020" }, { "category": "external", "summary": "SUSE Bug 1124342 for CVE-2019-1000020", "url": "https://bugzilla.suse.com/1124342" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2019-1000020" }, { "cve": "CVE-2019-18408", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-18408" } ], "notes": [ { "category": "general", "text": "archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-18408", "url": "https://www.suse.com/security/cve/CVE-2019-18408" }, { "category": "external", "summary": "SUSE Bug 1155079 for CVE-2019-18408", "url": "https://bugzilla.suse.com/1155079" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-18408" }, { "cve": "CVE-2019-19221", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-19221" } ], "notes": [ { "category": "general", "text": "In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-19221", "url": "https://www.suse.com/security/cve/CVE-2019-19221" }, { "category": "external", "summary": "SUSE Bug 1157569 for CVE-2019-19221", "url": "https://bugzilla.suse.com/1157569" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.s390x", "openSUSE Tumbleweed:bsdtar-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive-devel-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-3.5.1-1.5.x86_64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.aarch64", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.ppc64le", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.s390x", "openSUSE Tumbleweed:libarchive13-32bit-3.5.1-1.5.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-19221" } ] }
suse-su-2019:0831-1
Vulnerability from csaf_suse
Published
2019-04-01 11:58
Modified
2019-04-01 11:58
Summary
Security update for libarchive
Notes
Title of the patch
Security update for libarchive
Description of the patch
This update for libarchive fixes the following issues:
Security issues fixed:
- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653)
- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654)
- CVE-2018-1000879: Fixed a NULL Pointer Dereference vulnerability in ACL parser (bsc#1120656)
- CVE-2018-1000880: Fixed an Improper Input Validation vulnerability in WARC parser (bsc#1120659)
- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341)
- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342)
Patchnames
SUSE-2019-831,SUSE-SLE-Module-Basesystem-15-2019-831,SUSE-SLE-Module-Development-Tools-15-2019-831
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for libarchive", "title": "Title of the patch" }, { "category": "description", "text": "This update for libarchive fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653)\n- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654)\n- CVE-2018-1000879: Fixed a NULL Pointer Dereference vulnerability in ACL parser (bsc#1120656)\n- CVE-2018-1000880: Fixed an Improper Input Validation vulnerability in WARC parser (bsc#1120659)\n- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341) \n- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342)\n", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-2019-831,SUSE-SLE-Module-Basesystem-15-2019-831,SUSE-SLE-Module-Development-Tools-15-2019-831", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_0831-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2019:0831-1", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20190831-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2019:0831-1", "url": "https://lists.suse.com/pipermail/sle-security-updates/2019-April/005278.html" }, { "category": "self", "summary": "SUSE Bug 1120653", "url": "https://bugzilla.suse.com/1120653" }, { "category": "self", "summary": "SUSE Bug 1120654", "url": "https://bugzilla.suse.com/1120654" }, { "category": "self", "summary": "SUSE Bug 1120656", "url": "https://bugzilla.suse.com/1120656" }, { "category": "self", "summary": "SUSE Bug 1120659", "url": "https://bugzilla.suse.com/1120659" }, { "category": "self", "summary": "SUSE Bug 1124341", "url": "https://bugzilla.suse.com/1124341" }, { "category": "self", "summary": "SUSE Bug 1124342", "url": "https://bugzilla.suse.com/1124342" }, { "category": "self", "summary": "SUSE CVE CVE-2018-1000877 page", "url": "https://www.suse.com/security/cve/CVE-2018-1000877/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-1000878 page", "url": "https://www.suse.com/security/cve/CVE-2018-1000878/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-1000879 page", "url": "https://www.suse.com/security/cve/CVE-2018-1000879/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-1000880 page", "url": "https://www.suse.com/security/cve/CVE-2018-1000880/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-1000019 page", "url": "https://www.suse.com/security/cve/CVE-2019-1000019/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-1000020 page", "url": "https://www.suse.com/security/cve/CVE-2019-1000020/" } ], "title": "Security update for libarchive", "tracking": { "current_release_date": "2019-04-01T11:58:49Z", "generator": { "date": "2019-04-01T11:58:49Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2019:0831-1", "initial_release_date": "2019-04-01T11:58:49Z", "revision_history": [ { "date": "2019-04-01T11:58:49Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "bsdtar-3.3.2-3.8.4.aarch64", "product": { "name": "bsdtar-3.3.2-3.8.4.aarch64", "product_id": "bsdtar-3.3.2-3.8.4.aarch64" } }, { "category": "product_version", "name": "libarchive-devel-3.3.2-3.8.4.aarch64", "product": { "name": "libarchive-devel-3.3.2-3.8.4.aarch64", "product_id": "libarchive-devel-3.3.2-3.8.4.aarch64" } }, { "category": "product_version", "name": "libarchive13-3.3.2-3.8.4.aarch64", "product": { "name": "libarchive13-3.3.2-3.8.4.aarch64", "product_id": "libarchive13-3.3.2-3.8.4.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "libarchive13-64bit-3.3.2-3.8.4.aarch64_ilp32", "product": { "name": "libarchive13-64bit-3.3.2-3.8.4.aarch64_ilp32", "product_id": "libarchive13-64bit-3.3.2-3.8.4.aarch64_ilp32" } } ], "category": "architecture", "name": "aarch64_ilp32" }, { "branches": [ { "category": "product_version", "name": "bsdtar-3.3.2-3.8.4.i586", "product": { "name": "bsdtar-3.3.2-3.8.4.i586", "product_id": "bsdtar-3.3.2-3.8.4.i586" } }, { "category": "product_version", "name": "libarchive-devel-3.3.2-3.8.4.i586", "product": { "name": "libarchive-devel-3.3.2-3.8.4.i586", "product_id": "libarchive-devel-3.3.2-3.8.4.i586" } }, { "category": "product_version", "name": "libarchive13-3.3.2-3.8.4.i586", "product": { "name": "libarchive13-3.3.2-3.8.4.i586", "product_id": "libarchive13-3.3.2-3.8.4.i586" } } ], "category": "architecture", "name": "i586" }, { "branches": [ { "category": "product_version", "name": "bsdtar-3.3.2-3.8.4.ppc64le", "product": { "name": "bsdtar-3.3.2-3.8.4.ppc64le", "product_id": "bsdtar-3.3.2-3.8.4.ppc64le" } }, { "category": "product_version", "name": "libarchive-devel-3.3.2-3.8.4.ppc64le", "product": { "name": "libarchive-devel-3.3.2-3.8.4.ppc64le", "product_id": "libarchive-devel-3.3.2-3.8.4.ppc64le" } }, { "category": "product_version", "name": "libarchive13-3.3.2-3.8.4.ppc64le", "product": { "name": "libarchive13-3.3.2-3.8.4.ppc64le", "product_id": "libarchive13-3.3.2-3.8.4.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "bsdtar-3.3.2-3.8.4.s390x", "product": { "name": "bsdtar-3.3.2-3.8.4.s390x", "product_id": "bsdtar-3.3.2-3.8.4.s390x" } }, { "category": "product_version", "name": "libarchive-devel-3.3.2-3.8.4.s390x", "product": { "name": "libarchive-devel-3.3.2-3.8.4.s390x", "product_id": "libarchive-devel-3.3.2-3.8.4.s390x" } }, { "category": "product_version", "name": "libarchive13-3.3.2-3.8.4.s390x", "product": { "name": "libarchive13-3.3.2-3.8.4.s390x", "product_id": "libarchive13-3.3.2-3.8.4.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "bsdtar-3.3.2-3.8.4.x86_64", "product": { "name": "bsdtar-3.3.2-3.8.4.x86_64", "product_id": "bsdtar-3.3.2-3.8.4.x86_64" } }, { "category": "product_version", "name": "libarchive-devel-3.3.2-3.8.4.x86_64", "product": { "name": "libarchive-devel-3.3.2-3.8.4.x86_64", "product_id": "libarchive-devel-3.3.2-3.8.4.x86_64" } }, { "category": "product_version", "name": "libarchive13-3.3.2-3.8.4.x86_64", "product": { "name": "libarchive13-3.3.2-3.8.4.x86_64", "product_id": "libarchive13-3.3.2-3.8.4.x86_64" } }, { "category": "product_version", "name": "libarchive13-32bit-3.3.2-3.8.4.x86_64", "product": { "name": "libarchive13-32bit-3.3.2-3.8.4.x86_64", "product_id": "libarchive13-32bit-3.3.2-3.8.4.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Module for Basesystem 15", "product": { "name": "SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-module-basesystem:15" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Module for Development Tools 15", "product": { "name": "SUSE Linux Enterprise Module for Development Tools 15", "product_id": "SUSE Linux Enterprise Module for Development Tools 15", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-module-development-tools:15" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-3.3.2-3.8.4.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64" }, "product_reference": "libarchive-devel-3.3.2-3.8.4.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-3.3.2-3.8.4.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le" }, "product_reference": "libarchive-devel-3.3.2-3.8.4.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-3.3.2-3.8.4.s390x as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x" }, "product_reference": "libarchive-devel-3.3.2-3.8.4.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-3.3.2-3.8.4.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64" }, "product_reference": "libarchive-devel-3.3.2-3.8.4.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-3.3.2-3.8.4.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64" }, "product_reference": "libarchive13-3.3.2-3.8.4.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-3.3.2-3.8.4.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le" }, "product_reference": "libarchive13-3.3.2-3.8.4.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-3.3.2-3.8.4.s390x as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x" }, "product_reference": "libarchive13-3.3.2-3.8.4.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-3.3.2-3.8.4.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64" }, "product_reference": "libarchive13-3.3.2-3.8.4.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" }, { "category": "default_component_of", "full_product_name": { "name": "bsdtar-3.3.2-3.8.4.aarch64 as component of SUSE Linux Enterprise Module for Development Tools 15", "product_id": "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64" }, "product_reference": "bsdtar-3.3.2-3.8.4.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15" }, { "category": "default_component_of", "full_product_name": { "name": "bsdtar-3.3.2-3.8.4.ppc64le as component of SUSE Linux Enterprise Module for Development Tools 15", "product_id": "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le" }, "product_reference": "bsdtar-3.3.2-3.8.4.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15" }, { "category": "default_component_of", "full_product_name": { "name": "bsdtar-3.3.2-3.8.4.s390x as component of SUSE Linux Enterprise Module for Development Tools 15", "product_id": "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x" }, "product_reference": "bsdtar-3.3.2-3.8.4.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15" }, { "category": "default_component_of", "full_product_name": { "name": "bsdtar-3.3.2-3.8.4.x86_64 as component of SUSE Linux Enterprise Module for Development Tools 15", "product_id": "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" }, "product_reference": "bsdtar-3.3.2-3.8.4.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-1000877", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-1000877" } ], "notes": [ { "category": "general", "text": "libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar-\u003elzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-1000877", "url": "https://www.suse.com/security/cve/CVE-2018-1000877" }, { "category": "external", "summary": "SUSE Bug 1120653 for CVE-2018-1000877", "url": "https://bugzilla.suse.com/1120653" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-04-01T11:58:49Z", "details": "low" } ], "title": "CVE-2018-1000877" }, { "cve": "CVE-2018-1000878", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-1000878" } ], "notes": [ { "category": "general", "text": "libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c that can result in Crash/DoS - it is unknown if RCE is possible. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-1000878", "url": "https://www.suse.com/security/cve/CVE-2018-1000878" }, { "category": "external", "summary": "SUSE Bug 1120654 for CVE-2018-1000878", "url": "https://bugzilla.suse.com/1120654" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-04-01T11:58:49Z", "details": "moderate" } ], "title": "CVE-2018-1000878" }, { "cve": "CVE-2018-1000879", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-1000879" } ], "notes": [ { "category": "general", "text": "libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted archive file.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-1000879", "url": "https://www.suse.com/security/cve/CVE-2018-1000879" }, { "category": "external", "summary": "SUSE Bug 1120656 for CVE-2018-1000879", "url": "https://bugzilla.suse.com/1120656" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-04-01T11:58:49Z", "details": "low" } ], "title": "CVE-2018-1000879" }, { "cve": "CVE-2018-1000880", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-1000880" } ], "notes": [ { "category": "general", "text": "libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-1000880", "url": "https://www.suse.com/security/cve/CVE-2018-1000880" }, { "category": "external", "summary": "SUSE Bug 1120659 for CVE-2018-1000880", "url": "https://bugzilla.suse.com/1120659" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-04-01T11:58:49Z", "details": "low" } ], "title": "CVE-2018-1000880" }, { "cve": "CVE-2019-1000019", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-1000019" } ], "notes": [ { "category": "general", "text": "libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-1000019", "url": "https://www.suse.com/security/cve/CVE-2019-1000019" }, { "category": "external", "summary": "SUSE Bug 1124341 for CVE-2019-1000019", "url": "https://bugzilla.suse.com/1124341" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-04-01T11:58:49Z", "details": "low" } ], "title": "CVE-2019-1000019" }, { "cve": "CVE-2019-1000020", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-1000020" } ], "notes": [ { "category": "general", "text": "libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-1000020", "url": "https://www.suse.com/security/cve/CVE-2019-1000020" }, { "category": "external", "summary": "SUSE Bug 1124342 for CVE-2019-1000020", "url": "https://bugzilla.suse.com/1124342" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4.x86_64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.aarch64", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.ppc64le", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.s390x", "SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2019-04-01T11:58:49Z", "details": "low" } ], "title": "CVE-2019-1000020" } ] }
wid-sec-w-2024-2070
Vulnerability from csaf_certbund
Published
2019-01-09 23:00
Modified
2024-10-27 23:00
Summary
libarchive: Mehrere Schwachstellen ermöglichen Denial of Service
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
libarchive ist eine C Bibliothek und ein Komandozeilen-Tool zum Lesen und Bearbeiten von tar, cpio, zip, ISO und anderen Formaten.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in libarchive ausnutzen, um einen Denial of Service Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux
- UNIX
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "libarchive ist eine C Bibliothek und ein Komandozeilen-Tool zum Lesen und Bearbeiten von tar, cpio, zip, ISO und anderen Formaten.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in libarchive ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- UNIX", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-2070 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2019/wid-sec-w-2024-2070.json" }, { "category": "self", "summary": "WID-SEC-2024-2070 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-2070" }, { "category": "external", "summary": "NATIONAL VULNERABILITY DATABASE vom 2019-01-09", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000879" }, { "category": "external", "summary": "NATIONAL VULNERABILITY DATABASE vom 2019-01-09", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000878" }, { "category": "external", "summary": "NATIONAL VULNERABILITY DATABASE vom 2019-01-09", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000877" }, { "category": "external", "summary": "NATIONAL VULNERABILITY DATABASE vom 2019-01-09", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000880" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:0831-1 vom 2019-04-01", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20190831-1.html" }, { "category": "external", "summary": "Arch Linux Security Advisory ASA-201906-21 vom 2019-06-25", "url": "https://security.archlinux.org/ASA-201906-21" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2019:2298 vom 2019-08-06", "url": "https://access.redhat.com/errata/RHSA-2019:2298" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2019:3698 vom 2019-11-05", "url": "https://access.redhat.com/errata/RHSA-2019:3698" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:3093-1 vom 2019-11-29", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20193093-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:3092-1 vom 2019-11-29", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20193092-1.html" }, { "category": "external", "summary": "F5 Security Advisory K000140964 vom 2024-09-06", "url": "https://my.f5.com/manage/s/article/K000140964" }, { "category": "external", "summary": "F5 Security Advisory K000148256 vom 2024-10-25", "url": "https://my.f5.com/manage/s/article/K000148256" } ], "source_lang": "en-US", "title": "libarchive: Mehrere Schwachstellen erm\u00f6glichen Denial of Service", "tracking": { "current_release_date": "2024-10-27T23:00:00.000+00:00", "generator": { "date": "2024-10-28T09:09:35.428+00:00", "engine": { "name": "BSI-WID", "version": "1.3.8" } }, "id": "WID-SEC-W-2024-2070", "initial_release_date": "2019-01-09T23:00:00.000+00:00", "revision_history": [ { "date": "2019-01-09T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2019-03-21T23:00:00.000+00:00", "number": "2", "summary": "Referenz(en) aufgenommen: FEDORA-2019-FBE83D0E32" }, { "date": "2019-04-01T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2019-06-25T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Arch Linux aufgenommen" }, { "date": "2019-08-06T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2019-11-05T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2019-11-28T23:00:00.000+00:00", "number": "7", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2024-09-05T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von F5 aufgenommen" }, { "date": "2024-10-27T23:00:00.000+00:00", "number": "9", "summary": "Neue Updates von F5 aufgenommen" } ], "status": "final", "version": "9" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "category": "product_name", "name": "F5 BIG-IP", "product": { "name": "F5 BIG-IP", "product_id": "T001663", "product_identification_helper": { "cpe": "cpe:/a:f5:big-ip:-" } } } ], "category": "vendor", "name": "F5" }, { "branches": [ { "category": "product_name", "name": "Open Source Arch Linux", "product": { "name": "Open Source Arch Linux", "product_id": "T013312", "product_identification_helper": { "cpe": "cpe:/o:archlinux:archlinux:-" } } }, { "branches": [ { "category": "product_version_range", "name": "\u003e=3.1.0", "product": { "name": "Open Source libarchive \u003e=3.1.0", "product_id": "T013363" } }, { "category": "product_version_range", "name": "\u003e=3.1.0", "product": { "name": "Open Source libarchive \u003e=3.1.0", "product_id": "T013363-fixed" } } ], "category": "product_name", "name": "libarchive" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-1000877", "notes": [ { "category": "description", "text": "In libarchive existieren mehrere Schwachstellen. Diese beruhen auf NULL Zeiger Dereferenzierungen, Use after Free oder Double Free Fehlern oder Fehlern bei der Validierung von Eingaben und befinden sich im ACL Parser, RAR Decoder und WARC Parser. Ein Angreifer kann dieses durch \u00dcbermittlung geeignet gestalteter Daten zu einem Denial of Service Angriff nutzen. Zur erfolgreichen Ausnutzung dieser Schwachstelle muss der Angreifer den Benutzer dazu bringen, eine modifizierte Datei zu \u00f6ffnen." } ], "product_status": { "known_affected": [ "2951", "T002207", "67646", "T013312", "T001663" ] }, "release_date": "2019-01-09T23:00:00.000+00:00", "title": "CVE-2018-1000877" }, { "cve": "CVE-2018-1000878", "notes": [ { "category": "description", "text": "In libarchive existieren mehrere Schwachstellen. Diese beruhen auf NULL Zeiger Dereferenzierungen, Use after Free oder Double Free Fehlern oder Fehlern bei der Validierung von Eingaben und befinden sich im ACL Parser, RAR Decoder und WARC Parser. Ein Angreifer kann dieses durch \u00dcbermittlung geeignet gestalteter Daten zu einem Denial of Service Angriff nutzen. Zur erfolgreichen Ausnutzung dieser Schwachstelle muss der Angreifer den Benutzer dazu bringen, eine modifizierte Datei zu \u00f6ffnen." } ], "product_status": { "known_affected": [ "2951", "T002207", "67646", "T013312", "T001663" ] }, "release_date": "2019-01-09T23:00:00.000+00:00", "title": "CVE-2018-1000878" }, { "cve": "CVE-2018-1000879", "notes": [ { "category": "description", "text": "In libarchive existieren mehrere Schwachstellen. Diese beruhen auf NULL Zeiger Dereferenzierungen, Use after Free oder Double Free Fehlern oder Fehlern bei der Validierung von Eingaben und befinden sich im ACL Parser, RAR Decoder und WARC Parser. Ein Angreifer kann dieses durch \u00dcbermittlung geeignet gestalteter Daten zu einem Denial of Service Angriff nutzen. Zur erfolgreichen Ausnutzung dieser Schwachstelle muss der Angreifer den Benutzer dazu bringen, eine modifizierte Datei zu \u00f6ffnen." } ], "product_status": { "known_affected": [ "2951", "T002207", "67646", "T013312", "T001663" ] }, "release_date": "2019-01-09T23:00:00.000+00:00", "title": "CVE-2018-1000879" }, { "cve": "CVE-2018-1000880", "notes": [ { "category": "description", "text": "In libarchive existieren mehrere Schwachstellen. Diese beruhen auf NULL Zeiger Dereferenzierungen, Use after Free oder Double Free Fehlern oder Fehlern bei der Validierung von Eingaben und befinden sich im ACL Parser, RAR Decoder und WARC Parser. Ein Angreifer kann dieses durch \u00dcbermittlung geeignet gestalteter Daten zu einem Denial of Service Angriff nutzen. Zur erfolgreichen Ausnutzung dieser Schwachstelle muss der Angreifer den Benutzer dazu bringen, eine modifizierte Datei zu \u00f6ffnen." } ], "product_status": { "known_affected": [ "2951", "T002207", "67646", "T013312", "T001663" ] }, "release_date": "2019-01-09T23:00:00.000+00:00", "title": "CVE-2018-1000880" } ] }
fkie_cve-2018-1000880
Vulnerability from fkie_nvd
Published
2018-12-20 17:29
Modified
2024-11-21 03:40
Severity ?
Summary
libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.
References
▶ | URL | Tags | |
---|---|---|---|
cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html | Mailing List, Third Party Advisory | |
cve@mitre.org | http://www.securityfocus.com/bid/106324 | Third Party Advisory, VDB Entry | |
cve@mitre.org | https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909 | Patch, Third Party Advisory | |
cve@mitre.org | https://github.com/libarchive/libarchive/pull/1105 | Third Party Advisory | |
cve@mitre.org | https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680 | Patch, Third Party Advisory | |
cve@mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/ | ||
cve@mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/ | ||
cve@mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/ | ||
cve@mitre.org | https://usn.ubuntu.com/3859-1/ | Third Party Advisory | |
cve@mitre.org | https://www.debian.org/security/2018/dsa-4360 | Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html | Mailing List, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/106324 | Third Party Advisory, VDB Entry | |
af854a3a-2127-422b-91ae-364da2661108 | https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909 | Patch, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://github.com/libarchive/libarchive/pull/1105 | Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680 | Patch, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/ | ||
af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/ | ||
af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/ | ||
af854a3a-2127-422b-91ae-364da2661108 | https://usn.ubuntu.com/3859-1/ | Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://www.debian.org/security/2018/dsa-4360 | Third Party Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
libarchive | libarchive | * | |
canonical | ubuntu_linux | 14.04 | |
canonical | ubuntu_linux | 16.04 | |
canonical | ubuntu_linux | 18.04 | |
canonical | ubuntu_linux | 18.10 | |
fedoraproject | fedora | 29 | |
fedoraproject | fedora | 30 | |
opensuse | leap | 15.0 |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*", "matchCriteriaId": "9AABA23E-DB9A-4138-A4DF-BE21AA3EE048", "versionEndExcluding": "3.4.0", "versionStartIncluding": "3.2.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084", "vulnerable": true }, { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B", "vulnerable": true }, { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D", "vulnerable": true }, { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*", "matchCriteriaId": "07C312A0-CD2C-4B9C-B064-6409B25C278F", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*", "matchCriteriaId": "D100F7CE-FC64-4CC6-852A-6136D72DA419", "vulnerable": true }, { "criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*", "matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3", "vulnerable": true }, { "criteria": "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*", "matchCriteriaId": "F1E78106-58E6-4D59-990F-75DA575BFAD9", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file." }, { "lang": "es", "value": "libarchive, con el commit con ID 9693801580c0cf7c70e862d305270a16b52826a7 y siguientes (desde la v3.2.0) contiene una vulnerabilidad CWE-20: validaci\u00f3n de entradas incorrecta en el analizador WARC (), en _warc_read(), que puede resultar en una denegaci\u00f3n de servicio (DoS) en tiempo de ejecuci\u00f3n casi infinito y uso de disco desde un archivo muy peque\u00f1o. El ataque parece ser explotable si una v\u00edctima abre un archivo WARC especialmente manipulado." } ], "id": "CVE-2018-1000880", "lastModified": "2024-11-21T03:40:34.317", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true } ], "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2018-12-20T17:29:01.300", "references": [ { "source": "cve@mitre.org", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/bid/106324" }, { "source": "cve@mitre.org", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "https://github.com/libarchive/libarchive/pull/1105" }, { "source": "cve@mitre.org", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680" }, { "source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/" }, { "source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/" }, { "source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "https://usn.ubuntu.com/3859-1/" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "https://www.debian.org/security/2018/dsa-4360" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/bid/106324" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "https://github.com/libarchive/libarchive/pull/1105" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "https://usn.ubuntu.com/3859-1/" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "https://www.debian.org/security/2018/dsa-4360" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-119" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
ghsa-vg7w-5p64-2q65
Vulnerability from github
Published
2022-05-13 01:18
Modified
2022-05-13 01:18
Severity ?
VLAI Severity ?
Details
libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.
{ "affected": [], "aliases": [ "CVE-2018-1000880" ], "database_specific": { "cwe_ids": [ "CWE-119" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2018-12-20T17:29:00Z", "severity": "MODERATE" }, "details": "libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.", "id": "GHSA-vg7w-5p64-2q65", "modified": "2022-05-13T01:18:47Z", "published": "2022-05-13T01:18:47Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000880" }, { "type": "WEB", "url": "https://github.com/libarchive/libarchive/pull/1105" }, { "type": "WEB", "url": "https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680" }, { "type": "WEB", "url": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF" }, { "type": "WEB", "url": "https://usn.ubuntu.com/3859-1" }, { "type": "WEB", "url": "https://www.debian.org/security/2018/dsa-4360" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html" }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/106324" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ] }
gsd-2018-1000880
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2018-1000880", "description": "libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.", "id": "GSD-2018-1000880", "references": [ "https://www.suse.com/security/cve/CVE-2018-1000880.html", "https://www.debian.org/security/2018/dsa-4360", "https://ubuntu.com/security/CVE-2018-1000880", "https://advisories.mageia.org/CVE-2018-1000880.html", "https://security.archlinux.org/CVE-2018-1000880" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2018-1000880" ], "details": "libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.", "id": "GSD-2018-1000880", "modified": "2023-12-13T01:22:27.508664Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "DATE_ASSIGNED": "2018-12-19T20:52:45.248774", "DATE_REQUESTED": "2018-12-13T09:53:50", "ID": "CVE-2018-1000880", "REQUESTER": "dja@axtens.net", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "USN-3859-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/3859-1/" }, { "name": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909", "refsource": "MISC", "url": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909" }, { "name": "DSA-4360", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2018/dsa-4360" }, { "name": "https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680", "refsource": "MISC", "url": "https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680" }, { "name": "https://github.com/libarchive/libarchive/pull/1105", "refsource": "MISC", "url": "https://github.com/libarchive/libarchive/pull/1105" }, { "name": "106324", "refsource": "BID", "url": "http://www.securityfocus.com/bid/106324" }, { "name": "FEDORA-2019-0233ec0ff3", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/" }, { "name": "FEDORA-2019-fbe83d0e32", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/" }, { "name": "FEDORA-2019-c595a93536", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/" }, { "name": "openSUSE-SU-2019:1196", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "3.4.0", "versionStartIncluding": "3.2.0", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-1000880" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-119" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680" }, { "name": "https://github.com/libarchive/libarchive/pull/1105", "refsource": "MISC", "tags": [ "Third Party Advisory" ], "url": "https://github.com/libarchive/libarchive/pull/1105" }, { "name": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909" }, { "name": "DSA-4360", "refsource": "DEBIAN", "tags": [ "Third Party Advisory" ], "url": "https://www.debian.org/security/2018/dsa-4360" }, { "name": "106324", "refsource": "BID", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/bid/106324" }, { "name": "USN-3859-1", "refsource": "UBUNTU", "tags": [ "Third Party Advisory" ], "url": "https://usn.ubuntu.com/3859-1/" }, { "name": "FEDORA-2019-0233ec0ff3", "refsource": "FEDORA", "tags": [ "Mailing List", "Release Notes", "Third Party Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/" }, { "name": "FEDORA-2019-fbe83d0e32", "refsource": "FEDORA", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/" }, { "name": "FEDORA-2019-c595a93536", "refsource": "FEDORA", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/" }, { "name": "openSUSE-SU-2019:1196", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 2.8, "impactScore": 3.6 } }, "lastModifiedDate": "2020-08-24T17:37Z", "publishedDate": "2018-12-20T17:29Z" } } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…