{"id":"CVE-2018-1000880","aliases":["BELL-CVE-2018-1000880","DEBIAN-CVE-2018-1000880","DSA-4360-1","EUVD-2018-2057","GHSA-vg7w-5p64-2q65","MGASA-2019-0030","SUSE-SU-2019:0831-1","UBUNTU-CVE-2018-1000880","USN-3859-1","openSUSE-SU-2019:1196-1","openSUSE-SU-2024:10925-1"],"status":"published","title":"libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0...","description":"libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0409,"percentile":0.90815,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2018-12-20T00:00:00Z","modified":"2026-10-20T10:48:20Z","fixes":[{"ecosystem":"Debian:12","package":"libarchive","fixed_in":["3.3.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libarchive","fixed_in":["3.3.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libarchive","fixed_in":["3.3.3-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libarchive","fixed_in":["3.2.2-3.1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-2+deb9u1"}]}],"versions":["3.2.2-2"],"bundled":10},{"source":"osv","ecosystem":"Mageia:6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-1.4.mga6"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-3.8.4"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-3.8.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.2"}]}],"versions":["3.2.2-3.1","3.2.2-3.1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-7ubuntu2.7"}]}],"versions":["3.1.2-5ubuntu1","3.1.2-7ubuntu1","3.1.2-7ubuntu2","3.1.2-7ubuntu2.1","3.1.2-7ubuntu2.2","3.1.2-7ubuntu2.3","3.1.2-7ubuntu2.4","3.1.2-7ubuntu2.6"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-11ubuntu0.16.04.5"}]}],"versions":["3.1.2-11build1","3.1.2-11ubuntu0.16.04.1","3.1.2-11ubuntu0.16.04.2","3.1.2-11ubuntu0.16.04.3","3.1.2-11ubuntu0.16.04.4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.2"}]}],"versions":["3.2.2-3.1","3.2.2-3.1ubuntu0.1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-lp150.7.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1.5"}]}],"bundled":12}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libarchive","product":"libarchive"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://usn.ubuntu.com/3859-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://www.debian.org/security/2018/dsa-4360","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/libarchive/libarchive/pull/1105","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://www.securityfocus.com/bid/106324","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000880"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF"},{"url":"https://usn.ubuntu.com/3859-1"},{"url":"https://github.com/advisories/GHSA-vg7w-5p64-2q65"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-1000880","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1000880","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0030.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24075","tags":["report"]},{"url":"http://lists.suse.com/pipermail/sle-security-updates/2018-December/004927.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190831-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1120653","tags":["report"]},{"url":"https://bugzilla.suse.com/1120654","tags":["report"]},{"url":"https://bugzilla.suse.com/1120656","tags":["report"]},{"url":"https://bugzilla.suse.com/1120659","tags":["report"]},{"url":"https://bugzilla.suse.com/1124341","tags":["report"]},{"url":"https://bugzilla.suse.com/1124342","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1000019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1000020","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-1000880","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3859-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14502","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000878","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TIJ7ZTUCNAB4P5RGZHQDF4OC3WRSBWO4/#TIJ7ZTUCNAB4P5RGZHQDF4OC3WRSBWO4","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-5680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19221","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1000880","description":"libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.","status":"published","published":"2018-12-20T17:00:00Z","modified":"2026-10-08T21:03:28.206Z","updated_at":"2026-11-02T14:35:10.685174Z"}],"euvd":[{"id":"EUVD-2018-2057","description":"libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.","status":"published","published":"2018-12-20T17:00:00Z","modified":"2026-10-08T21:03:28Z","updated_at":"2026-11-02T17:27:26.856493Z"}],"ghsa":[{"id":"GHSA-vg7w-5p64-2q65","title":"libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0...","description":"libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.","status":"published","published":"2022-05-13T01:18:47Z","modified":"2026-10-08T21:33:19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:12:57.86261Z"}],"nvd":[{"id":"CVE-2018-1000880","description":"libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.","status":"published","published":"2018-12-20T17:29:01.3Z","modified":"2026-10-08T21:17:07.197Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:04:50.99633Z"}],"osv":[{"id":"BELL-CVE-2018-1000880","title":"CVE-2018-1000880 does not affect BellSoft software","status":"withdrawn","published":"2018-12-20T17:29:00Z","modified":"2026-01-26T09:47:41.358398Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-1000880","description":"libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.","status":"published","published":"2018-12-20T17:29:01.3Z","modified":"2026-10-20T10:48:20.570669889Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-1000880","description":"libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.","status":"published","published":"2018-12-20T17:29:01.3Z","modified":"2026-10-09T09:47:23.876172151Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"UBUNTU-CVE-2018-1000880","description":"libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.","status":"published","published":"2018-12-20T00:00:00Z","modified":"2026-04-22T11:39:55.209356Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DSA-4360-1","title":"libarchive - security update","status":"published","published":"2018-12-27T00:00:00Z","modified":"2026-03-09T02:10:40.03087Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0030","title":"Updated libarchive packages fix security vulnerabilities","description":"read_header in archive_read_support_format_rar.c in libarchive 3.3.2\nsuffers from an off-by-one error for UTF-16 names in RAR archives,\nleading to an out-of-bounds read in archive_read_format_rar_read_header\n(CVE-2017-14502).\n\nMultiple security issues were found in libarchive: Processing malformed\nRAR archives could result in denial of service or the execution of\narbitrary code and malformed WARC, LHarc, ISO, Xar or CAB archives could\nresult in denial of service (CVE-2018-1000877, CVE-2018-1000878,\nCVE-2018-1000879, CVE-2018-1000880).\n","status":"published","published":"2019-01-11T05:54:06Z","modified":"2026-04-16T06:25:35.756198883Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1196-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653)\n- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654)\n- CVE-2018-1000879: Fixed a NULL Pointer Dereference vulnerability in ACL parser (bsc#1120656)\n- CVE-2018-1000880: Fixed an Improper Input Validation vulnerability in WARC parser (bsc#1120659)\n- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341) \n- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-12T07:23:10Z","modified":"2026-02-04T03:53:45.20014Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10925-1","title":"bsdtar-3.5.1-1.5 on GA media","description":"These are all security issues fixed in the bsdtar-3.5.1-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:39:18.303089Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:0831-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653)\n- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654)\n- CVE-2018-1000879: Fixed a NULL Pointer Dereference vulnerability in ACL parser (bsc#1120656)\n- CVE-2018-1000880: Fixed an Improper Input Validation vulnerability in WARC parser (bsc#1120659)\n- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341) \n- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342)\n","status":"published","published":"2019-04-01T11:58:49Z","modified":"2026-02-04T03:31:45.058688Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3859-1","title":"libarchive vulnerabilities","description":"It was discovered that libarchive incorrectly handled certain archive files.\nAn attacker could possibly use this issue to cause a denial of service.\nCVE-2018-1000880 affected only Ubuntu 18.04 LTS and Ubuntu 18.10.\n(CVE-2018-1000877, CVE-2018-1000878, CVE-2018-1000880)\n\nIt was discovered that libarchive incorrectly handled certain archive files.\nAn attacker could possibly use this issue to expose sensitive information.\nThis issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n(CVE-2017-14502)\n","status":"published","published":"2019-01-15T13:40:36Z","modified":"2026-04-22T09:53:41.706268Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}