{"id":"CVE-2018-1000877","aliases":["BELL-CVE-2018-1000877","DEBIAN-CVE-2018-1000877","DLA-1612-1","DSA-4360-1","EUVD-2018-2054","GHSA-rfww-wwgq-55v3","MGASA-2019-0030","RHSA-2019:2298","RHSA-2019:3698","SUSE-SU-2019:0831-1","SUSE-SU-2019:3092-1","SUSE-SU-2019:3093-1","UBUNTU-CVE-2018-1000877","USN-3859-1","openSUSE-SU-2019:1196-1","openSUSE-SU-2019:2615-1","openSUSE-SU-2019:2632-1","openSUSE-SU-2024:10925-1"],"status":"published","title":"libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0...","description":"libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar-\u003elzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04575,"percentile":0.91686,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2018-12-20T00:00:00Z","modified":"2026-10-23T18:03:22Z","fixes":[{"ecosystem":"Debian:12","package":"libarchive","fixed_in":["3.3.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libarchive","fixed_in":["3.3.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libarchive","fixed_in":["3.3.3-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libarchive","fixed_in":["3.1.2-7ubuntu2.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libarchive","fixed_in":["3.1.2-11ubuntu0.16.04.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libarchive","fixed_in":["3.2.2-3.1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-11+deb8u6"}]}],"versions":["3.1.2-11","3.1.2-11+deb8u1","3.1.2-11+deb8u2","3.1.2-11+deb8u3","3.1.2-11+deb8u3~bpo70+1","3.1.2-11+deb8u4","3.1.2-11+deb8u5"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-2+deb9u1"}]}],"versions":["3.2.2-2"],"bundled":10},{"source":"osv","ecosystem":"Mageia:6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-1.4.mga6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-7.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-7.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-7.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-7.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-7.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-7.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-7.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-7.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-7.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-7.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-7.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-7.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-7.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-3.8.4"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-3.8.4"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-26.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-26.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-26.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-26.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-26.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-26.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-26.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-3.11.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-3.11.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-3.11.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-3.11.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-7ubuntu2.7"}]}],"versions":["3.1.2-5ubuntu1","3.1.2-7ubuntu1","3.1.2-7ubuntu2","3.1.2-7ubuntu2.1","3.1.2-7ubuntu2.2","3.1.2-7ubuntu2.3","3.1.2-7ubuntu2.4","3.1.2-7ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-11ubuntu0.16.04.5"}]}],"versions":["3.1.2-11build1","3.1.2-11ubuntu0.16.04.1","3.1.2-11ubuntu0.16.04.2","3.1.2-11ubuntu0.16.04.3","3.1.2-11ubuntu0.16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.2"}]}],"versions":["3.2.2-3.1","3.2.2-3.1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-7ubuntu2.7"}]}],"versions":["3.1.2-5ubuntu1","3.1.2-7ubuntu1","3.1.2-7ubuntu2","3.1.2-7ubuntu2.1","3.1.2-7ubuntu2.2","3.1.2-7ubuntu2.3","3.1.2-7ubuntu2.4","3.1.2-7ubuntu2.6"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-11ubuntu0.16.04.5"}]}],"versions":["3.1.2-11build1","3.1.2-11ubuntu0.16.04.1","3.1.2-11ubuntu0.16.04.2","3.1.2-11ubuntu0.16.04.3","3.1.2-11ubuntu0.16.04.4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.2"}]}],"versions":["3.2.2-3.1","3.2.2-3.1ubuntu0.1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-lp150.7.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-lp150.10.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-lp151.5.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1.5"}]}],"bundled":12}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libarchive","product":"libarchive"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://usn.ubuntu.com/3859-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/12/msg00011.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2018/dsa-4360","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/libarchive/libarchive/pull/1105/commits/021efa522ad729ff0f5806c4ce53e4a6cc1daa31","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/libarchive/libarchive/pull/1105","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://www.securityfocus.com/bid/106324","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2298","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3698","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00012.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000877","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/"},{"url":"https://github.com/advisories/GHSA-rfww-wwgq-55v3"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-1000877","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1000877","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0030.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24075","tags":["report"]},{"url":"http://lists.suse.com/pipermail/sle-security-updates/2018-December/004927.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1494449","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1663887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1663889","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1672888","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1672892","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2298.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-14503","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-14503","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-14503","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000877","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000877","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000878","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000878","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000878","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1000019","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1000019","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1000019","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1000020","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1000020","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1000020","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3698.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190831-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1120653","tags":["report"]},{"url":"https://bugzilla.suse.com/1120654","tags":["report"]},{"url":"https://bugzilla.suse.com/1120656","tags":["report"]},{"url":"https://bugzilla.suse.com/1120659","tags":["report"]},{"url":"https://bugzilla.suse.com/1124341","tags":["report"]},{"url":"https://bugzilla.suse.com/1124342","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1000019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1000020","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193092-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1032089","tags":["report"]},{"url":"https://bugzilla.suse.com/1037008","tags":["report"]},{"url":"https://bugzilla.suse.com/1037009","tags":["report"]},{"url":"https://bugzilla.suse.com/1059134","tags":["report"]},{"url":"https://bugzilla.suse.com/1059139","tags":["report"]},{"url":"https://bugzilla.suse.com/1155079","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18408","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193093-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-1000877","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3859-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-14502","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000880","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TIJ7ZTUCNAB4P5RGZHQDF4OC3WRSBWO4/#TIJ7ZTUCNAB4P5RGZHQDF4OC3WRSBWO4","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U6XQ3DWFEKK5LGAFI7F4YVSON52JVUJE/#U6XQ3DWFEKK5LGAFI7F4YVSON52JVUJE","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BCNN5SKOY4P2IA35RL7MCURKXTITD75T/#BCNN5SKOY4P2IA35RL7MCURKXTITD75T","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-5680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19221","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1000877","description":"libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar-\u003elzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.","status":"published","published":"2018-12-20T17:00:00Z","modified":"2024-08-05T12:47:57.461Z","updated_at":"2026-11-02T14:35:10.685174Z"}],"euvd":[{"id":"EUVD-2018-2054","description":"libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar-\u003elzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.","status":"published","published":"2018-12-20T17:00:00Z","modified":"2024-08-05T12:47:57Z","updated_at":"2026-11-03T02:39:25.8334Z"}],"ghsa":[{"id":"GHSA-rfww-wwgq-55v3","title":"libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0...","description":"libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar-\u003elzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.","status":"published","published":"2022-05-13T01:30:43Z","modified":"2023-02-01T05:08:01Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:50:40.02829Z"}],"nvd":[{"id":"CVE-2018-1000877","description":"libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar-\u003elzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.","status":"published","published":"2018-12-20T17:29:01.097Z","modified":"2026-06-17T01:33:14.253Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:04:50.99633Z"}],"osv":[{"id":"BELL-CVE-2018-1000877","title":"CVE-2018-1000877 does not affect BellSoft software","status":"withdrawn","published":"2018-12-20T17:29:00Z","modified":"2026-01-26T09:46:07.707319Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-1000877","description":"libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar-\u003elzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.","status":"published","published":"2018-12-20T17:29:01.097Z","modified":"2026-10-20T10:49:40.311628641Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-1000877","description":"libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar-\u003elzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.","status":"published","published":"2018-12-20T17:29:01.097Z","modified":"2026-10-23T18:03:22.883478478Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2019:2298","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2024-09-16T02:20:09Z","modified":"2026-06-26T12:21:07.90654933Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:3698","title":"Red Hat Security Advisory: libarchive security and bug fix update","status":"published","published":"2024-09-16T02:20:16Z","modified":"2026-06-26T12:21:59.85929732Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2018-1000877","description":"libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar-\u003elzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.","status":"published","published":"2018-12-20T00:00:00Z","modified":"2026-04-22T11:39:55.26755Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DLA-1612-1","title":"libarchive - security update","status":"published","published":"2018-12-21T00:00:00Z","modified":"2026-03-09T01:22:47.997037Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4360-1","title":"libarchive - security update","status":"published","published":"2018-12-27T00:00:00Z","modified":"2026-03-09T02:10:40.03087Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0030","title":"Updated libarchive packages fix security vulnerabilities","description":"read_header in archive_read_support_format_rar.c in libarchive 3.3.2\nsuffers from an off-by-one error for UTF-16 names in RAR archives,\nleading to an out-of-bounds read in archive_read_format_rar_read_header\n(CVE-2017-14502).\n\nMultiple security issues were found in libarchive: Processing malformed\nRAR archives could result in denial of service or the execution of\narbitrary code and malformed WARC, LHarc, ISO, Xar or CAB archives could\nresult in denial of service (CVE-2018-1000877, CVE-2018-1000878,\nCVE-2018-1000879, CVE-2018-1000880).\n","status":"published","published":"2019-01-11T05:54:06Z","modified":"2026-04-16T06:25:35.756198883Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1196-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653)\n- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654)\n- CVE-2018-1000879: Fixed a NULL Pointer Dereference vulnerability in ACL parser (bsc#1120656)\n- CVE-2018-1000880: Fixed an Improper Input Validation vulnerability in WARC parser (bsc#1120659)\n- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341) \n- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-12T07:23:10Z","modified":"2026-02-04T03:53:45.20014Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2615-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653).\n- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654).\n- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341).\n- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342).\n- CVE-2019-18408: Fixed a use-after-free in RAR format support (bsc#1155079).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-12-03T14:47:57Z","modified":"2026-02-04T04:31:13.659379Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2019:2632-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653).\n- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654).\n- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341).\n- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342).\n- CVE-2019-18408: Fixed a use-after-free in RAR format support (bsc#1155079).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-12-03T19:15:57Z","modified":"2026-02-04T04:02:02.139615Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10925-1","title":"bsdtar-3.5.1-1.5 on GA media","description":"These are all security issues fixed in the bsdtar-3.5.1-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:39:18.303089Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:0831-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653)\n- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654)\n- CVE-2018-1000879: Fixed a NULL Pointer Dereference vulnerability in ACL parser (bsc#1120656)\n- CVE-2018-1000880: Fixed an Improper Input Validation vulnerability in WARC parser (bsc#1120659)\n- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341) \n- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342)\n","status":"published","published":"2019-04-01T11:58:49Z","modified":"2026-02-04T03:31:45.058688Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:3092-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653).\n- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654).\n- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341).\n- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342).\n- CVE-2019-18408: Fixed a use-after-free in RAR format support (bsc#1155079).\n","status":"published","published":"2019-11-28T14:44:46Z","modified":"2026-02-04T03:01:10.015504Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:3093-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653).\n- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654).\n- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341).\n- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342).\n- CVE-2019-18408: Fixed a use-after-free in RAR format support (bsc#1155079).\n","status":"published","published":"2019-11-28T14:45:18Z","modified":"2026-02-04T04:02:46.000108Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-3859-1","title":"libarchive vulnerabilities","description":"It was discovered that libarchive incorrectly handled certain archive files.\nAn attacker could possibly use this issue to cause a denial of service.\nCVE-2018-1000880 affected only Ubuntu 18.04 LTS and Ubuntu 18.10.\n(CVE-2018-1000877, CVE-2018-1000878, CVE-2018-1000880)\n\nIt was discovered that libarchive incorrectly handled certain archive files.\nAn attacker could possibly use this issue to expose sensitive information.\nThis issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n(CVE-2017-14502)\n","status":"published","published":"2019-01-15T13:40:36Z","modified":"2026-04-22T09:53:41.706268Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}