Every CVE Search/ Get API key

CVE-2020-9308

archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with...

8.8 HighFix available

archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.25%Up 0.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.

Record
CVE-2020-9308
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.

Record
CVE-2020-9308
Updated
2026-11-02
EUVDEUVD-2020-30132 No score

archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.

Record
EUVD-2020-30132
Updated
2026-11-03
GitHub AdvisoriesGHSA-mgg9-26cw-p92x No score

archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with...

archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.

Record
GHSA-mgg9-26cw-p92x
Weakness
CWE-20, CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2020-9308 8.8

archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.

Record
ALPINE-CVE-2020-9308
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2020-9308 8.8

CVE-2020-9308 does not affect BellSoft software

Record
BELL-CVE-2020-9308
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.8

archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.

Record
CVE-2020-9308
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-9308 8.8

archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.

Record
DEBIAN-CVE-2020-9308
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2020-0127 No score

Updated libarchive packages fix security vulnerabilities

The updated packages fix several issues including security vulnerabilities:

In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive. (CVE-2019-19221)

archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact. (CVE-2020-9308)

Record
MGASA-2020-0127
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libarchive
Alpine:v3.11
 3.4.0 up to 3.4.2-r0
3.4.2-r0
libarchive
Alpine:v3.12
 3.4.0 up to 3.4.2-r0
3.4.2-r0
libarchive
Alpine:v3.13
 3.4.0 up to 3.4.2-r0
3.4.2-r0
libarchive
Alpine:v3.14
 3.4.0 up to 3.4.2-r0
3.4.2-r0
libarchive
Alpine:v3.15
 3.4.0 up to 3.4.2-r0
3.4.2-r0
libarchive
Alpine:v3.16
 3.4.0 up to 3.4.2-r0
3.4.2-r0
libarchive
Alpine:v3.17
 3.4.0 up to 3.4.2-r0
3.4.2-r0
libarchive
Alpine:v3.18
 3.4.0 up to 3.4.2-r0
3.4.2-r0
libarchive
Alpine:v3.19
 3.4.0 up to 3.4.2-r0
3.4.2-r0
libarchive
Alpine:v3.20
 3.4.0 up to 3.4.2-r0
3.4.2-r0
Show 8 moreShow less
Affected packages
PackageAffectedFixed
libarchive
Alpine:v3.21
 3.4.0 up to 3.4.2-r0
3.4.2-r0
libarchive
Alpine:v3.22
 3.4.0 up to 3.4.2-r0
3.4.2-r0
libarchive
Alpine:v3.23
 3.4.0 up to 3.4.2-r0
3.4.2-r0
libarchive
Alpine:v3.24
 3.4.0 up to 3.4.2-r0
3.4.2-r0
libarchive
Debian:12
 before 3.4.0-2
3.4.0-2
libarchive
Debian:13
 before 3.4.0-2
3.4.0-2
libarchive
Debian:14
 before 3.4.0-2
3.4.0-2
libarchive
Mageia:7
From an advisory covering 2 CVEs
 before 3.4.0-1.1.mga7
3.4.0-1.1.mga7

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-9308 is a high vulnerability (CVSS 8.8) in Libarchive, published February 20, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.25%, the 82nd percentile. Fixed in libarchive 3.4.2-r0.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open