{"id":"CVE-2019-18408","aliases":["ALPINE-CVE-2019-18408","BELL-CVE-2019-18408","DEBIAN-CVE-2019-18408","DLA-1971-1","DSA-4557-1","EUVD-2019-8180","GHSA-4hj2-55w3-4qwh","RHSA-2020:0203","RHSA-2020:0246","RHSA-2020:0271","SUSE-RU-2021:2757-1","SUSE-SU-2019:3092-1","SUSE-SU-2019:3093-1","UBUNTU-CVE-2019-18408","USN-4169-1","openSUSE-SU-2019:2615-1","openSUSE-SU-2019:2632-1","openSUSE-SU-2024:10925-1"],"status":"published","title":"archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0...","description":"archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0404,"percentile":0.90692,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2019-10-24T13:37:39Z","modified":"2026-09-21T07:01:16Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"libarchive","fixed_in":["3.3.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"libarchive","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"libarchive","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libarchive","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libarchive","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libarchive","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libarchive","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libarchive","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libarchive","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libarchive","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libarchive","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libarchive","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libarchive","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libarchive","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libarchive","fixed_in":["3.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"libarchive","fixed_in":["3.3.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"libarchive","fixed_in":["3.3.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"libarchive","fixed_in":["3.3.3-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libarchive","fixed_in":["3.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libarchive","fixed_in":["3.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libarchive","fixed_in":["3.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libarchive","fixed_in":["3.1.2-11+deb8u8"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"libarchive","fixed_in":["3.2.2-2+deb9u2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"libarchive","fixed_in":["3.3.3-4+deb10u1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libarchive","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libarchive-debuginfo","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bsdcpio","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bsdtar","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libarchive-devel","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libarchive","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libarchive-debuginfo","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bsdcpio","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bsdtar","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libarchive-devel","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libarchive","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libarchive-debuginfo","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bsdcpio","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bsdtar","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libarchive-devel","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libarchive","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libarchive-debuginfo","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bsdcpio","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bsdtar","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libarchive-devel","fixed_in":["0:3.1.2-14.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.3.2-4.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.3.2-4.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"bsdtar","fixed_in":["0:3.3.2-4.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.3.2-4.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"libarchive","fixed_in":["0:3.3.2-4.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.3.2-4.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"libarchive-debugsource","fixed_in":["0:3.3.2-4.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.3.2-8.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.3.2-8.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdtar","fixed_in":["0:3.3.2-8.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.3.2-8.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive","fixed_in":["0:3.3.2-8.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.3.2-8.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive-debugsource","fixed_in":["0:3.3.2-8.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdcat-debuginfo","fixed_in":["0:3.3.2-8.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdcpio-debuginfo","fixed_in":["0:3.3.2-8.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdtar-debuginfo","fixed_in":["0:3.3.2-8.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-debuginfo","fixed_in":["0:3.3.2-8.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-debugsource","fixed_in":["0:3.3.2-8.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-devel","fixed_in":["0:3.3.2-8.el8_1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","fixed_in":["3.1.2-7ubuntu2.8+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libarchive","fixed_in":["3.1.2-11ubuntu0.16.04.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libarchive","fixed_in":["3.2.2-3.1ubuntu0.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-11+deb8u8"}]}],"versions":["3.1.2-11","3.1.2-11+deb8u1","3.1.2-11+deb8u2","3.1.2-11+deb8u3","3.1.2-11+deb8u3~bpo70+1","3.1.2-11+deb8u4","3.1.2-11+deb8u5","3.1.2-11+deb8u6","3.1.2-11+deb8u7"]},{"source":"osv","ecosystem":"Debian:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-2+deb9u2"}]}],"versions":["3.2.2-2","3.2.2-2+deb9u1"]},{"source":"osv","ecosystem":"Debian:10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-4+deb10u1"}]}],"versions":["3.3.3-4"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-4.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-4.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-4.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-4.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-4.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-4.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-4.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-3.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-26.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-26.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-26.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-26.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-26.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-26.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-26.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-3.11.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-3.11.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-3.11.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-3.11.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-7ubuntu2.8+esm1"}]}],"versions":["3.1.2-5ubuntu1","3.1.2-7ubuntu1","3.1.2-7ubuntu2","3.1.2-7ubuntu2.1","3.1.2-7ubuntu2.2","3.1.2-7ubuntu2.3","3.1.2-7ubuntu2.4","3.1.2-7ubuntu2.6","3.1.2-7ubuntu2.7","3.1.2-7ubuntu2.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-11ubuntu0.16.04.7"}]}],"versions":["3.1.2-11build1","3.1.2-11ubuntu0.16.04.1","3.1.2-11ubuntu0.16.04.2","3.1.2-11ubuntu0.16.04.3","3.1.2-11ubuntu0.16.04.4","3.1.2-11ubuntu0.16.04.5","3.1.2-11ubuntu0.16.04.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.5"}]}],"versions":["3.2.2-3.1","3.2.2-3.1ubuntu0.1","3.2.2-3.1ubuntu0.2","3.2.2-3.1ubuntu0.3","3.2.2-3.1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-7ubuntu2.8+esm1"}]}],"versions":["3.1.2-5ubuntu1","3.1.2-7ubuntu1","3.1.2-7ubuntu2","3.1.2-7ubuntu2.1","3.1.2-7ubuntu2.2","3.1.2-7ubuntu2.3","3.1.2-7ubuntu2.4","3.1.2-7ubuntu2.6","3.1.2-7ubuntu2.7","3.1.2-7ubuntu2.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-11ubuntu0.16.04.7"}]}],"versions":["3.1.2-11build1","3.1.2-11ubuntu0.16.04.1","3.1.2-11ubuntu0.16.04.2","3.1.2-11ubuntu0.16.04.3","3.1.2-11ubuntu0.16.04.4","3.1.2-11ubuntu0.16.04.5","3.1.2-11ubuntu0.16.04.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.5"}]}],"versions":["3.2.2-3.1","3.2.2-3.1ubuntu0.1","3.2.2-3.1ubuntu0.2","3.2.2-3.1ubuntu0.3","3.2.2-3.1ubuntu0.4"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-lp150.10.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-lp151.5.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1.5"}]}],"bundled":12}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"libarchive","product":"libarchive"}],"references":[{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14689","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/libarchive/libarchive/commit/b8592ecba2f9e451e1f5cb7ab6dcee8b8e7b3f60","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/libarchive/libarchive/compare/v3.3.3...v3.4.0","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00034.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4169-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4557","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://seclists.org/bugtraq/2019/Nov/2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://support.f5.com/csp/article/K52144175?utm_source=f5support\u0026amp%3Butm_medium=RSS","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00012.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0246","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0271","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0203","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/202003-28","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LZ4VJGTCYEJSDLOEWUUFG6TM4SUPFSY/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18408","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LZ4VJGTCYEJSDLOEWUUFG6TM4SUPFSY"},{"url":"https://usn.ubuntu.com/4169-1"},{"url":"https://github.com/advisories/GHSA-4hj2-55w3-4qwh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-18408","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-18408","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-18408","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1769979","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0203.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-18408","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-18408","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0246.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0271.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2021-2757/suse-ru-20212757-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188891","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18408","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193092-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1032089","tags":["report"]},{"url":"https://bugzilla.suse.com/1037008","tags":["report"]},{"url":"https://bugzilla.suse.com/1037009","tags":["report"]},{"url":"https://bugzilla.suse.com/1059134","tags":["report"]},{"url":"https://bugzilla.suse.com/1059139","tags":["report"]},{"url":"https://bugzilla.suse.com/1120653","tags":["report"]},{"url":"https://bugzilla.suse.com/1120654","tags":["report"]},{"url":"https://bugzilla.suse.com/1124341","tags":["report"]},{"url":"https://bugzilla.suse.com/1124342","tags":["report"]},{"url":"https://bugzilla.suse.com/1155079","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1000019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1000020","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193093-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-18408","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4169-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U6XQ3DWFEKK5LGAFI7F4YVSON52JVUJE/#U6XQ3DWFEKK5LGAFI7F4YVSON52JVUJE","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BCNN5SKOY4P2IA35RL7MCURKXTITD75T/#BCNN5SKOY4P2IA35RL7MCURKXTITD75T","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-5680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19221","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-18408","description":"archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.","status":"published","published":"2019-10-24T13:37:39Z","modified":"2024-08-05T01:54:14.375Z","updated_at":"2026-11-02T14:32:23.803059Z"}],"euvd":[{"id":"EUVD-2019-8180","description":"archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.","status":"published","published":"2019-10-24T13:37:39Z","modified":"2024-08-05T01:54:14Z","updated_at":"2026-11-03T02:40:28.293703Z"}],"ghsa":[{"id":"GHSA-4hj2-55w3-4qwh","title":"archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0...","description":"archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.","status":"published","published":"2022-05-24T16:59:50Z","modified":"2024-04-04T02:34:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:56:09.334021Z"}],"nvd":[{"id":"CVE-2019-18408","description":"archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.","status":"published","published":"2019-10-24T14:15:11.457Z","modified":"2026-06-17T02:24:58.727Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:05:32.982925Z"}],"osv":[{"id":"ALPINE-CVE-2019-18408","description":"archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.","status":"published","published":"2019-10-24T14:15:11.457Z","modified":"2026-09-21T06:17:52.502811118Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-18408","title":"CVE-2019-18408 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:53.111675Z","modified":"2026-01-26T09:49:16.991155Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-18408","description":"archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.","status":"published","published":"2019-10-24T14:15:11.457Z","modified":"2026-04-11T14:11:12.771351Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-18408","description":"archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.","status":"published","published":"2019-10-24T14:15:11.457Z","modified":"2026-09-21T07:01:16.502122479Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"RHSA-2020:0203","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2024-09-16T03:27:52Z","modified":"2026-06-26T12:21:08.645373967Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0246","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2024-09-16T03:27:59Z","modified":"2025-11-22T11:54:43Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0271","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2024-09-16T03:28:07Z","modified":"2026-06-26T12:21:57.51309412Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2019-18408","description":"archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.","status":"published","published":"2019-10-24T14:15:00Z","modified":"2026-04-22T12:14:10.535067Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DLA-1971-1","title":"libarchive - security update","status":"published","published":"2019-10-26T00:00:00Z","modified":"2026-03-09T01:22:43.808086Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4557-1","title":"libarchive - security update","status":"published","published":"2019-10-31T00:00:00Z","modified":"2026-03-09T02:09:09.738596Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2019:2615-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653).\n- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654).\n- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341).\n- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342).\n- CVE-2019-18408: Fixed a use-after-free in RAR format support (bsc#1155079).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-12-03T14:47:57Z","modified":"2026-02-04T04:31:13.659379Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2019:2632-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653).\n- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654).\n- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341).\n- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342).\n- CVE-2019-18408: Fixed a use-after-free in RAR format support (bsc#1155079).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-12-03T19:15:57Z","modified":"2026-02-04T04:02:02.139615Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10925-1","title":"bsdtar-3.5.1-1.5 on GA media","description":"These are all security issues fixed in the bsdtar-3.5.1-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:39:18.303089Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-RU-2021:2757-1","title":"Recommended update for libarchive","description":"This update for libarchive fixes the following issues:\n\nlibarchive was updated to version 3.3.3\n\n* Avoid super-linear slowdown on malformed mtree files\n* Many fixes for building with Visual Studio\n* NO_OVERWRITE doesn't change existing directory attributes\n* New support for Zstandard read and write filters\n* Fixes CVE-2017-14501, CVE-2017-14502, CVE-2017-14503\n- Needed by of Firefox91 (bsc#1188891)\n","status":"published","published":"2021-08-17T11:47:07Z","modified":"2026-02-04T02:59:53.326998Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2019:3092-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653).\n- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654).\n- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341).\n- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342).\n- CVE-2019-18408: Fixed a use-after-free in RAR format support (bsc#1155079).\n","status":"published","published":"2019-11-28T14:44:46Z","modified":"2026-02-04T03:01:10.015504Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:3093-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653).\n- CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654).\n- CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341).\n- CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342).\n- CVE-2019-18408: Fixed a use-after-free in RAR format support (bsc#1155079).\n","status":"published","published":"2019-11-28T14:45:18Z","modified":"2026-02-04T04:02:46.000108Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4169-1","title":"libarchive vulnerability","description":"It was discovered that libarchive incorrectly handled certain archive files.\nAn attacker could possibly execute arbitrary code.\n","status":"published","published":"2019-10-29T17:11:28Z","modified":"2026-06-29T13:47:43.163951576Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}