CVE-2018-1000097
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in...
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file..
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file..
- Record
CVE-2018-1000097- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file..
- Record
CVE-2018-1000097- Updated
- 2026-11-02
EUVDEUVD-2018-1835 No score
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file..
- Record
EUVD-2018-1835- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vp78-rw8x-8cfq
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in...
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file..
- Record
GHSA-vp78-rw8x-8cfq- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVAZL-35251
CVE-2018-1000097 affecting package sharutils for versions less than 4.15.2-21
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file..
- Record
AZL-35251- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVAZL-6876
CVE-2018-1000097 affecting package sharutils for versions less than 4.15.2-20
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file..
- Record
AZL-6876- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSV
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file..
- Record
CVE-2018-1000097- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-1000097
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file..
- Record
DEBIAN-CVE-2018-1000097- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1000097
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file..
- Record
UBUNTU-CVE-2018-1000097- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11380-1 No score
sharutils-4.15.2-6.9 on GA media
These are all security issues fixed in the sharutils-4.15.2-6.9 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11380-1- Updated
- 2026-11-02
OSVUSN-3605-1 No score
sharutils vulnerability
It was discovered that Sharutils incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code.
- Record
USN-3605-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sharutilsAzure Linux:3 |
before 4.15.2-21 | 4.15.2-21 |
sharutilsAzure Linux:2 |
before 4.15.2-20 | 4.15.2-20 |
sharutilsDebian:12 |
before 1:4.15.2-3 | 1:4.15.2-3 |
sharutilsDebian:13 |
before 1:4.15.2-3 | 1:4.15.2-3 |
sharutilsDebian:14 |
before 1:4.15.2-3 | 1:4.15.2-3 |
sharutilsDebian:8 |
before 1:4.14-2+deb8u1, plus listed versions 1:4.14-2 |
1:4.14-2+deb8u1 |
sharutilsDebian:9 |
before 1:4.15.2-2+deb9u1, plus listed versions 1:4.15.2-2 |
1:4.15.2-2+deb9u1 |
sharutilsUbuntu:14.04:LTS |
before 1:4.14-1ubuntu1.1, plus listed versions 1:4.11.1-1ubuntu21:4.14-1ubuntu1 |
1:4.14-1ubuntu1.1 |
sharutilsUbuntu:16.04:LTS |
before 1:4.15.2-1ubuntu0.1, plus listed versions 1:4.15.2-1 |
1:4.15.2-1ubuntu0.1 |
sharutilsopenSUSE:Tumbleweed |
before 4.15.2-6.9 | 4.15.2-6.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000097 is a high vulnerability (CVSS 7.8) in Gnu Sharutils, published March 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.96%, the 80th percentile. Fixed in sharutils 4.15.2-21.