CVE-2012-6706

A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the "DestPos" variable, which allows the attacker to write out of bounds when setting Mem[DestPos].

A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the "DestPos" variable, which allows the attacker to write out of bounds when setting Mem[DestPos].

VMSF_DELTA memory corruption (CVE-2012-6706).

Directory traversal issue in UnRAR before 5.5.7 (CVE-2017-12938).

libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function (CVE-2017-12940).

libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function (CVE-2017-12941).

libunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ function (CVE-2017-12942).

These are all security issues fixed in the clamav-0.103.3-1.4 package on the GA media of openSUSE Tumbleweed.

This update for clamav fixes the following issues:

Security issue fixed:

• CVE-2012-6706: Fixed an arbitrary memory write in VMSF_DELTA filter in libclamunrar (bsc#1045490)

Non security issues fixed:

• Provide and obsolete clamav-nodb to trigger its removal in openSUSE Leap. (bsc#1040662)

This update for unrar fixes the following issues:

• CVE-2012-6706: decoding malicious RAR files could have lead to memory corruption or code execution. (bsc#1045315).

This update for unrar fixes the following issues:

• CVE-2012-6706: decoding malicious RAR files could have lead to memory corruption or code execution. (bsc#1045315).

This update for clamav fixes the following issues:

Security issue fixed:

• CVE-2012-6706: Fixed an arbitrary memory write in VMSF_DELTA filter in libclamunrar (bsc#1045490)

Non security issue fixed:

• Fix permissions of /var/spool/amavis. (bsc#815106)

This update for clamav fixes the following issues:

Security issues fixed:

• CVE-2012-6706: VMSF_DELTA filter inside the unrar implementation allows an arbitrary memory write (bsc#1045315).
• CVE-2017-6419: A heap-based buffer overflow that can lead to a denial of service in libmspack via a crafted CHM file (bsc#1052449).
• CVE-2017-11423: A stack-based buffer over-read that can lead to a denial of service in mspack via a crafted CAB file (bsc#1049423).
• CVE-2018-1000085: An out-of-bounds heap read vulnerability was found in XAR parser that can lead to a denial of service (bsc#1082858).
• CVE-2018-0202: Fixed two vulnerabilities in the PDF parsing code (bsc#1083915).

This update for unrar to version 5.6.1 fixes several issues.

These security issues were fixed:

• CVE-2017-12938: Prevent remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file (bsc#1054038).
• CVE-2017-12940: Prevent out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function (bsc#1054038).
• CVE-2017-12941: Prevent an out-of-bounds read in the Unpack::Unpack20 function (bsc#1054038).
• CVE-2017-12942: Prevent a buffer overflow in the Unpack::LongLZ function (bsc#1054038).

These non-security issues were fixed:

• Added extraction support for .LZ archives created by Lzip compressor
• Enable unpacking of files in ZIP archives compressed with XZ algorithm and encrypted with AES
• Added support for PAX extended headers inside of TAR archive
• If RAR recovery volumes (.rev files) are present in the same folder as usual RAR volumes, archive test command verifies .rev contents after completing testing .rar files
• By default unrar skips symbolic links with absolute paths in link target when extracting unless -ola command line switch is specified
• Added support for AES-NI CPU instructions
• Support for a new RAR 5.0 archiving format
• Wildcard exclusion mask for folders
• Added libunrar* and libunrar*-devel subpackages (bsc#513804)
• Prevent conditional jumps depending on uninitialised values (bsc#1046882)

This update for clamav fixes the following issues:

Security issues fixed:

• CVE-2012-6706: VMSF_DELTA filter inside the unrar implementation allows an arbitrary memory write (bsc#1045315).
• CVE-2017-6419: A heap-based buffer overflow that can lead to a denial of service in libmspack via a crafted CHM file (bsc#1052449).
• CVE-2017-11423: A stack-based buffer over-read that can lead to a denial of service in mspack via a crafted CAB file (bsc#1049423).
• CVE-2018-1000085: An out-of-bounds heap read vulnerability was found in XAR parser that can lead to a denial of service (bsc#1082858).
• CVE-2018-0202: Fixed two vulnerabilities in the PDF parsing code (bsc#1083915).

This update for unrar to version 5.6.1 fixes several issues.

These security issues were fixed:

• CVE-2017-12938: Prevent remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file (bsc#1054038).
• CVE-2017-12940: Prevent out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function (bsc#1054038).
• CVE-2017-12941: Prevent an out-of-bounds read in the Unpack::Unpack20 function (bsc#1054038).
• CVE-2017-12942: Prevent a buffer overflow in the Unpack::LongLZ function (bsc#1054038).
• CVE-2017-20006: Fixed heap-based buffer overflow in Unpack:CopyString (bsc#1187974).

These non-security issues were fixed:

• Added extraction support for .LZ archives created by Lzip compressor
• Enable unpacking of files in ZIP archives compressed with XZ algorithm and encrypted with AES
• Added support for PAX extended headers inside of TAR archive
• If RAR recovery volumes (.rev files) are present in the same folder as usual RAR volumes, archive test command verifies .rev contents after completing testing .rar files
• By default unrar skips symbolic links with absolute paths in link target when extracting unless -ola command line switch is specified
• Added support for AES-NI CPU instructions
• Support for a new RAR 5.0 archiving format
• Wildcard exclusion mask for folders
• Prevent conditional jumps depending on uninitialised values (bsc#1046882)