Security update for libarchive SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:0831-1 Final 1 1 2019-04-01T11:58:49Z current 2019-04-01T11:58:49Z 2019-04-01T11:58:49Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libarchive This update for libarchive fixes the following issues: Security issues fixed: - CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653) - CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654) - CVE-2018-1000879: Fixed a NULL Pointer Dereference vulnerability in ACL parser (bsc#1120656) - CVE-2018-1000880: Fixed an Improper Input Validation vulnerability in WARC parser (bsc#1120659) - CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341) - CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server-2019-831,Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server-2019-831,Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server-2019-831,Image SLES15-SP1-SAPCAL-Azure-2019-831,Image SLES15-SP1-SAPCAL-EC2-HVM-2019-831,Image SLES15-SP1-SAPCAL-GCE-2019-831,SUSE-2019-831,SUSE-SLE-Module-Basesystem-15-2019-831,SUSE-SLE-Module-Development-Tools-15-2019-831 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20190831-1/ Link for SUSE-SU-2019:0831-1 https://lists.suse.com/pipermail/sle-security-updates/2019-April/005278.html E-Mail link for SUSE-SU-2019:0831-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1120653 SUSE Bug 1120653 https://bugzilla.suse.com/1120654 SUSE Bug 1120654 https://bugzilla.suse.com/1120656 SUSE Bug 1120656 https://bugzilla.suse.com/1120659 SUSE Bug 1120659 https://bugzilla.suse.com/1124341 SUSE Bug 1124341 https://bugzilla.suse.com/1124342 SUSE Bug 1124342 https://www.suse.com/security/cve/CVE-2018-1000877/ SUSE CVE CVE-2018-1000877 page https://www.suse.com/security/cve/CVE-2018-1000878/ SUSE CVE CVE-2018-1000878 page https://www.suse.com/security/cve/CVE-2018-1000879/ SUSE CVE CVE-2018-1000879 page https://www.suse.com/security/cve/CVE-2018-1000880/ SUSE CVE CVE-2018-1000880 page https://www.suse.com/security/cve/CVE-2019-1000019/ SUSE CVE CVE-2019-1000019 page https://www.suse.com/security/cve/CVE-2019-1000020/ SUSE CVE CVE-2019-1000020 page Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server Image SLES15-SP1-SAPCAL-Azure Image SLES15-SP1-SAPCAL-EC2-HVM Image SLES15-SP1-SAPCAL-GCE SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Development Tools 15 libarchive13-3.3.2-3.8.4 bsdtar-3.3.2-3.8.4 libarchive-devel-3.3.2-3.8.4 libarchive13-32bit-3.3.2-3.8.4 libarchive13-64bit-3.3.2-3.8.4 libarchive13-3.3.2-3.8.4 as a component of Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server libarchive13-3.3.2-3.8.4 as a component of Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server libarchive13-3.3.2-3.8.4 as a component of Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server libarchive13-3.3.2-3.8.4 as a component of Image SLES15-SP1-SAPCAL-Azure libarchive13-3.3.2-3.8.4 as a component of Image SLES15-SP1-SAPCAL-EC2-HVM libarchive13-3.3.2-3.8.4 as a component of Image SLES15-SP1-SAPCAL-GCE libarchive-devel-3.3.2-3.8.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 libarchive13-3.3.2-3.8.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 bsdtar-3.3.2-3.8.4 as a component of SUSE Linux Enterprise Module for Development Tools 15 libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar->lzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive. CVE-2018-1000877 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-Azure:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-EC2-HVM:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-GCE:libarchive13-3.3.2-3.8.4 SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4 SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4 SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190831-1/ https://www.suse.com/security/cve/CVE-2018-1000877.html CVE-2018-1000877 https://bugzilla.suse.com/1120653 SUSE Bug 1120653 libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c that can result in Crash/DoS - it is unknown if RCE is possible. This attack appear to be exploitable via the victim must open a specially crafted RAR archive. CVE-2018-1000878 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-Azure:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-EC2-HVM:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-GCE:libarchive13-3.3.2-3.8.4 SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4 SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4 SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190831-1/ https://www.suse.com/security/cve/CVE-2018-1000878.html CVE-2018-1000878 https://bugzilla.suse.com/1120654 SUSE Bug 1120654 libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted archive file. CVE-2018-1000879 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-Azure:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-EC2-HVM:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-GCE:libarchive13-3.3.2-3.8.4 SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4 SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4 SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190831-1/ https://www.suse.com/security/cve/CVE-2018-1000879.html CVE-2018-1000879 https://bugzilla.suse.com/1120656 SUSE Bug 1120656 libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file. CVE-2018-1000880 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-Azure:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-EC2-HVM:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-GCE:libarchive13-3.3.2-3.8.4 SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4 SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4 SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190831-1/ https://www.suse.com/security/cve/CVE-2018-1000880.html CVE-2018-1000880 https://bugzilla.suse.com/1120659 SUSE Bug 1120659 libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file. CVE-2019-1000019 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-Azure:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-EC2-HVM:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-GCE:libarchive13-3.3.2-3.8.4 SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4 SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4 SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190831-1/ https://www.suse.com/security/cve/CVE-2019-1000019.html CVE-2019-1000019 https://bugzilla.suse.com/1124341 SUSE Bug 1124341 libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file. CVE-2019-1000020 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-Azure:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-EC2-HVM:libarchive13-3.3.2-3.8.4 Image SLES15-SP1-SAPCAL-GCE:libarchive13-3.3.2-3.8.4 SUSE Linux Enterprise Module for Basesystem 15:libarchive-devel-3.3.2-3.8.4 SUSE Linux Enterprise Module for Basesystem 15:libarchive13-3.3.2-3.8.4 SUSE Linux Enterprise Module for Development Tools 15:bsdtar-3.3.2-3.8.4 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190831-1/ https://www.suse.com/security/cve/CVE-2019-1000020.html CVE-2019-1000020 https://bugzilla.suse.com/1124342 SUSE Bug 1124342