{"id":"CVE-2019-20509","aliases":["EUVD-2019-11053","GHSA-wpgg-gcgq-v3vh","MGASA-2020-0253","UBUNTU-CVE-2019-20509"],"status":"rejected","title":"archive_read_support_format_lha.c in libarchive before 3.4.1 does not ensure valid sizes for UTF...","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it only affected a development version. Notes: none","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2020-03-10T13:37:26Z","modified":"2026-04-16T04:43:06Z","fixes":[{"ecosystem":"Mageia:7","package":"libarchive","fixed_in":["3.4.3-1.mga7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:7","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1.mga7"}]}]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20509"},{"url":"https://github.com/libarchive/libarchive/issues/1284"},{"url":"https://github.com/libarchive/libarchive/commit/91cf9372e89f7af4582964b15ceb7fc6d1b37471"},{"url":"https://github.com/libarchive/libarchive/compare/v3.4.0...v3.4.1","tags":["report"]},{"url":"https://github.com/advisories/GHSA-wpgg-gcgq-v3vh"},{"url":"https://advisories.mageia.org/MGASA-2020-0253.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26691","tags":["report"]},{"url":"https://github.com/libarchive/libarchive/releases/tag/v3.4.1","tags":["web"]},{"url":"https://github.com/libarchive/libarchive/releases/tag/v3.4.2","tags":["web"]},{"url":"https://github.com/libarchive/libarchive/releases/tag/v3.4.3","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6OTE7GWASH2ZOVG5H3HEN5PR6B3KF7JB/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-20509","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20509","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-20509","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it only affected a development version. Notes: none","status":"rejected","published":"2020-03-10T13:37:26Z","modified":"2020-03-12T13:56:28Z","updated_at":"2026-11-02T14:20:17.431882Z"}],"euvd":[{"id":"EUVD-2019-11053","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it only affected a development version. Notes: none","status":"published","published":"2020-03-10T13:37:26Z","modified":"2020-03-12T13:56:28Z","updated_at":"2026-11-03T03:51:24.089619Z"}],"ghsa":[{"id":"GHSA-wpgg-gcgq-v3vh","title":"archive_read_support_format_lha.c in libarchive before 3.4.1 does not ensure valid sizes for UTF...","description":"archive_read_support_format_lha.c in libarchive before 3.4.1 does not ensure valid sizes for UTF-16 input, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted LHA archive.","status":"published","published":"2022-05-24T17:10:37Z","modified":"2023-01-29T05:01:55Z","updated_at":"2026-11-02T14:44:56.825456Z"}],"nvd":[{"id":"CVE-2019-20509","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it only affected a development version. Notes: none","status":"rejected","published":"2020-03-10T14:15:12.05Z","modified":"2023-11-07T03:09:10.65Z","updated_at":"2026-11-02T14:05:45.254119Z"}],"osv":[{"id":"UBUNTU-CVE-2019-20509","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it only affected a development version. Notes: none.","status":"withdrawn","published":"2020-03-10T14:15:00Z","modified":"2025-07-08T14:44:30.322111Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"MGASA-2020-0253","title":"Updated libarchive packages fix security vulnerability","description":"Updated libarchive packages fix security vulnerability:\n\narchive_read_support_format_lha.c in libarchive before 3.4.1 does not\nensure valid sizes for UTF-16 input, which allows remote attackers to\ncause a denial of service (heap-based buffer over-read and application\ncrash) via a crafted LHA archive (CVE-2019-20509).\n\nThe libarchive package has been updated to version 3.4.3, fixing this\nissue and other bugs.\n","status":"published","published":"2020-06-10T22:57:01Z","modified":"2026-04-16T04:43:06.1440555Z","updated_at":"2026-11-02T15:49:41.151324Z"}]}}