{"id":"CVE-2018-17093","aliases":["EUVD-2018-8873","openSUSE-SU-2026:11103-1","openSUSE-SU-2026:21153-1"],"status":"rejected","title":"libxar-devel-1.8.0.0.503-1.1 on GA media","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-11125. Reason: This candidate is a duplicate of CVE-2017-11125. Notes: All CVE users should reference CVE-2017-11125 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2018-09-16T21:00:00Z","modified":"2026-06-30T18:24:46Z","affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.0.503-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"xar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.0.503-bp160.1.1"}]}],"bundled":4}],"references":[{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17094","tags":["web"]},{"url":"https://bugzilla.suse.com/1047874","tags":["report"]},{"url":"https://bugzilla.suse.com/1047875","tags":["report"]},{"url":"https://bugzilla.suse.com/1108595","tags":["report"]},{"url":"https://bugzilla.suse.com/1108596","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-17093","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-11125. Reason: This candidate is a duplicate of CVE-2017-11125. Notes: All CVE users should reference CVE-2017-11125 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2018-09-16T21:00:00Z","modified":"2020-02-10T16:30:41Z","updated_at":"2026-11-02T14:35:07.354449Z"}],"euvd":[{"id":"EUVD-2018-8873","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-11125. Reason: This candidate is a duplicate of CVE-2017-11125. Notes: All CVE users should reference CVE-2017-11125 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"published","published":"2018-09-16T21:00:00Z","modified":"2020-02-10T16:30:41Z","updated_at":"2026-11-03T03:51:24.089619Z"}],"nvd":[{"id":"CVE-2018-17093","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-11125. Reason: This candidate is a duplicate of CVE-2017-11125. Notes: All CVE users should reference CVE-2017-11125 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2018-09-16T21:29:00.61Z","modified":"2023-11-07T02:54:10.197Z","updated_at":"2026-11-02T14:04:40.661264Z"}],"osv":[{"id":"openSUSE-SU-2026:11103-1","title":"libxar-devel-1.8.0.0.503-1.1 on GA media","description":"These are all security issues fixed in the libxar-devel-1.8.0.0.503-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-22T00:00:00Z","modified":"2026-06-24T09:00:05.119519667Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21153-1","title":"Security update for xar","description":"This update for xar fixes the following issues:\n\nChanges in xar:\n\n- Switch to the maintained Apple xar lineage (build 503, versioned\n  1.8.0.0.503): the mackyle 1.6.1 fork this package tracked has been\n  dead since 2012, and Debian, Fedora and Gentoo all moved to Apple's\n  xar (apple-oss-distributions/xar). This resolves the long-standing\n  NULL-pointer dereferences in xar_get_path() and xar_unserialize()\n  when parsing malformed archives:\n  * CVE-2017-11124 (boo#1047875)\n  * CVE-2017-11125 (boo#1047874)\n  * CVE-2018-17093 (boo#1108595)\n  * CVE-2018-17094 (boo#1108596)\n","status":"published","published":"2026-06-23T13:02:10Z","modified":"2026-06-30T18:24:46.131507698Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}