CVE-2017-12940
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call...
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function.
- Record
CVE-2017-12940- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function.
- Record
CVE-2017-12940- Updated
- 2026-11-02
EUVDEUVD-2017-4464 No score
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function.
- Record
EUVD-2017-4464- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7rmv-8xhh-9hgp
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call...
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function.
- Record
GHSA-7rmv-8xhh-9hgp- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function.
- Record
CVE-2017-12940- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-12940
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function.
- Record
DEBIAN-CVE-2017-12940- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2017-12940
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function.
- Record
UBUNTU-CVE-2017-12940- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0302 No score
Updated unrar packages fix security vulnerabilities
VMSF_DELTA memory corruption (CVE-2012-6706).
Directory traversal issue in UnRAR before 5.5.7 (CVE-2017-12938).
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function (CVE-2017-12940).
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function (CVE-2017-12941).
libunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ function (CVE-2017-12942).
- Record
MGASA-2017-0302- Updated
- 2026-11-02
OSVMGASA-2017-0304 No score
Updated unrar packages fix security vulnerabilities
Directory traversal issue in UnRAR before 5.5.7 (CVE-2017-12938).
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function (CVE-2017-12940).
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function (CVE-2017-12941).
libunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ function (CVE-2017-12942).
- Record
MGASA-2017-0304- Updated
- 2026-11-02
OSVSUSE-SU-2018:0862-1 No score
Security update for unrar
This update for unrar to version 5.6.1 fixes several issues.
These security issues were fixed:
- CVE-2017-12938: Prevent remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file (bsc#1054038).
- CVE-2017-12940: Prevent out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function (bsc#1054038).
- CVE-2017-12941: Prevent an out-of-bounds read in the Unpack::Unpack20 function (bsc#1054038).
- CVE-2017-12942: Prevent a buffer overflow in the Unpack::LongLZ function (bsc#1054038).
These non-security issues were fixed:
- Added extraction support for .LZ archives created by Lzip compressor
- Enable unpacking of files in ZIP archives compressed with XZ algorithm and encrypted with AES
- Added support for PAX extended headers inside of TAR archive
- If RAR recovery volumes (.rev files) are present in the same folder as usual RAR volumes, archive test command verifies .rev contents after completing testing .rar files
- By default unrar skips symbolic links with absolute paths in link target when extracting unless -ola command line switch is specified
- Added support for AES-NI CPU instructions
- Support for a new RAR 5.0 archiving format
- Wildcard exclusion mask for folders
- Added libunrar* and libunrar*-devel subpackages (bsc#513804)
- Prevent conditional jumps depending on uninitialised values (bsc#1046882)
- Record
SUSE-SU-2018:0862-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:2834-1 No score
Security update for unrar
This update for unrar to version 5.6.1 fixes several issues.
These security issues were fixed:
- CVE-2017-12938: Prevent remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file (bsc#1054038).
- CVE-2017-12940: Prevent out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function (bsc#1054038).
- CVE-2017-12941: Prevent an out-of-bounds read in the Unpack::Unpack20 function (bsc#1054038).
- CVE-2017-12942: Prevent a buffer overflow in the Unpack::LongLZ function (bsc#1054038).
- CVE-2017-20006: Fixed heap-based buffer overflow in Unpack:CopyString (bsc#1187974).
These non-security issues were fixed:
- Added extraction support for .LZ archives created by Lzip compressor
- Enable unpacking of files in ZIP archives compressed with XZ algorithm and encrypted with AES
- Added support for PAX extended headers inside of TAR archive
- If RAR recovery volumes (.rev files) are present in the same folder as usual RAR volumes, archive test command verifies .rev contents after completing testing .rar files
- By default unrar skips symbolic links with absolute paths in link target when extracting unless -ola command line switch is specified
- Added support for AES-NI CPU instructions
- Support for a new RAR 5.0 archiving format
- Wildcard exclusion mask for folders
- Prevent conditional jumps depending on uninitialised values (bsc#1046882)
- Record
SUSE-SU-2021:2834-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
unrar-nonfreeDebian:12 |
before 1:5.5.8-1, plus listed versions 1:3.5.2-0.11:3.5.2-0.21:3.5.4-0.11:3.5.4-11:3.5.4-1.1 Show 30 moreShow less1:3.7.2-11:3.7.3-11:3.7.3-1.11:3.7.8-11:3.7.8-21:3.8.2-11:3.8.4-11:3.8.5-11:3.8.5-21:3.9.10-11:3.9.3-11:3.9.5-11:3.9.6-11:3.9.7-11:3.9.9-11:4.0.2-11:4.0.3-11:4.1.4-11:4.2.4-0.11:4.2.4-0.21:4.2.4-0.31:5.0.10-11:5.2.5-11:5.2.7-0.11:5.3.2-11:5.4.5-11:5.5.5-13.3.6-23.3.6-2.0.13.4.3-1 |
1:5.5.8-1 |
unrar-nonfreeDebian:13 |
before 1:5.5.8-1, plus listed versions 1:3.5.2-0.11:3.5.2-0.21:3.5.4-0.11:3.5.4-11:3.5.4-1.1 Show 30 moreShow less1:3.7.2-11:3.7.3-11:3.7.3-1.11:3.7.8-11:3.7.8-21:3.8.2-11:3.8.4-11:3.8.5-11:3.8.5-21:3.9.10-11:3.9.3-11:3.9.5-11:3.9.6-11:3.9.7-11:3.9.9-11:4.0.2-11:4.0.3-11:4.1.4-11:4.2.4-0.11:4.2.4-0.21:4.2.4-0.31:5.0.10-11:5.2.5-11:5.2.7-0.11:5.3.2-11:5.4.5-11:5.5.5-13.3.6-23.3.6-2.0.13.4.3-1 |
1:5.5.8-1 |
unrar-nonfreeDebian:14 |
before 1:5.5.8-1, plus listed versions 1:3.5.2-0.11:3.5.2-0.21:3.5.4-0.11:3.5.4-11:3.5.4-1.1 Show 30 moreShow less1:3.7.2-11:3.7.3-11:3.7.3-1.11:3.7.8-11:3.7.8-21:3.8.2-11:3.8.4-11:3.8.5-11:3.8.5-21:3.9.10-11:3.9.3-11:3.9.5-11:3.9.6-11:3.9.7-11:3.9.9-11:4.0.2-11:4.0.3-11:4.1.4-11:4.2.4-0.11:4.2.4-0.21:4.2.4-0.31:5.0.10-11:5.2.5-11:5.2.7-0.11:5.3.2-11:5.4.5-11:5.5.5-13.3.6-23.3.6-2.0.13.4.3-1 |
1:5.5.8-1 |
unrarMageia:5 |
before 5.50-1.mga5.nonfree | 5.50-1.mga5.nonfree |
unrarMageia:6 |
before 5.50-1.mga6.nonfree | 5.50-1.mga6.nonfree |
unrarSUSE:Linux Enterprise Server 11 SP4 |
before 5.6.1-5.3.1 | 5.6.1-5.3.1 |
unrarSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 5.6.1-5.3.1 | 5.6.1-5.3.1 |
unrarSUSE:OpenStack Cloud 8 |
before 5.6.1-4.5.1 | 5.6.1-4.5.1 |
unrarSUSE:OpenStack Cloud 9 |
before 5.6.1-4.5.1 | 5.6.1-4.5.1 |
unrarSUSE:OpenStack Cloud Crowbar 9 |
before 5.6.1-4.5.1 | 5.6.1-4.5.1 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
unrarSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 5.6.1-4.5.1 | 5.6.1-4.5.1 |
unrarSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 5.6.1-4.5.1 | 5.6.1-4.5.1 |
unrarSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 5.6.1-4.5.1 | 5.6.1-4.5.1 |
unrarSUSE:Linux Enterprise Server 12 SP2-BCL |
before 5.6.1-4.5.1 | 5.6.1-4.5.1 |
unrarSUSE:Linux Enterprise Server 12 SP3-LTSS |
before 5.6.1-4.5.1 | 5.6.1-4.5.1 |
unrarSUSE:Linux Enterprise Server 12 SP3-BCL |
before 5.6.1-4.5.1 | 5.6.1-4.5.1 |
unrarSUSE:Linux Enterprise Server 12 SP4-LTSS |
before 5.6.1-4.5.1 | 5.6.1-4.5.1 |
unrarSUSE:Linux Enterprise Server 12 SP5 |
before 5.6.1-4.5.1 | 5.6.1-4.5.1 |
unrarSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 5.6.1-4.5.1 | 5.6.1-4.5.1 |
unrar-nonfreeUbuntu:16.04:LTS |
All versions, plus listed versions 1:5.3.2-11:5.3.2-1+deb9u1build0.16.04.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-12940 is a critical vulnerability (CVSS 9.8) in Rarlab Unrar, published August 18, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.20%, the 82nd percentile. Fixed in unrar-nonfree 1:5.5.8-1.
References
seclists.org/oss-sec/2017/q3/290
kc.mcafee.com/corporate/index?page=content&id=SB10241
security.gentoo.org/glsa/201709-24
nvd.nist.gov/vuln/detail/CVE-2017-12940
github.com/advisories/GHSA-7rmv-8xhh-9hgp
security-tracker.debian.org/tracker/CVE-2017-12940
Show 22 moreShow less
advisories.mageia.org/MGASA-2017-0302.html
bugs.mageia.org/show_bug.cgi?id=21134
lists.opensuse.org/opensuse-updates/2017-06/msg00085.html
openwall.com/lists/oss-security/2017/08/18/2
suse.com/support/update/announcement/2018/suse-su-20180862-1
bugzilla.suse.com/1046882
ubuntu.com/security/CVE-2017-12940
cve.org/CVERecord?id=CVE-2017-12940