Security update for libarchive SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:3092-1 Final 1 1 2019-11-28T14:44:46Z current 2019-11-28T14:44:46Z 2019-11-28T14:44:46Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libarchive This update for libarchive fixes the following issues: Security issues fixed: - CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653). - CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654). - CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341). - CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342). - CVE-2019-18408: Fixed a use-after-free in RAR format support (bsc#1155079). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-3092,SUSE-SLE-DESKTOP-12-SP4-2019-3092,SUSE-SLE-SDK-12-SP4-2019-3092,SUSE-SLE-SDK-12-SP5-2019-3092,SUSE-SLE-SERVER-12-SP4-2019-3092,SUSE-SLE-SERVER-12-SP5-2019-3092 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20193092-1/ Link for SUSE-SU-2019:3092-1 https://lists.suse.com/pipermail/sle-security-updates/2019-November/006201.html E-Mail link for SUSE-SU-2019:3092-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1032089 SUSE Bug 1032089 https://bugzilla.suse.com/1037008 SUSE Bug 1037008 https://bugzilla.suse.com/1037009 SUSE Bug 1037009 https://bugzilla.suse.com/1059134 SUSE Bug 1059134 https://bugzilla.suse.com/1059139 SUSE Bug 1059139 https://bugzilla.suse.com/1120653 SUSE Bug 1120653 https://bugzilla.suse.com/1120654 SUSE Bug 1120654 https://bugzilla.suse.com/1124341 SUSE Bug 1124341 https://bugzilla.suse.com/1124342 SUSE Bug 1124342 https://bugzilla.suse.com/1155079 SUSE Bug 1155079 https://www.suse.com/security/cve/CVE-2016-10209/ SUSE CVE CVE-2016-10209 page https://www.suse.com/security/cve/CVE-2016-10349/ SUSE CVE CVE-2016-10349 page https://www.suse.com/security/cve/CVE-2016-10350/ SUSE CVE CVE-2016-10350 page https://www.suse.com/security/cve/CVE-2017-14501/ SUSE CVE CVE-2017-14501 page https://www.suse.com/security/cve/CVE-2017-14502/ SUSE CVE CVE-2017-14502 page https://www.suse.com/security/cve/CVE-2018-1000877/ SUSE CVE CVE-2018-1000877 page https://www.suse.com/security/cve/CVE-2018-1000878/ SUSE CVE CVE-2018-1000878 page https://www.suse.com/security/cve/CVE-2019-1000019/ SUSE CVE CVE-2019-1000019 page https://www.suse.com/security/cve/CVE-2019-1000020/ SUSE CVE CVE-2019-1000020 page https://www.suse.com/security/cve/CVE-2019-18408/ SUSE CVE CVE-2019-18408 page SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP5 bsdtar-3.1.2-26.6.1 libarchive-devel-3.1.2-26.6.1 libarchive13-3.1.2-26.6.1 libarchive13-32bit-3.1.2-26.6.1 libarchive13-64bit-3.1.2-26.6.1 libarchive13-3.1.2-26.6.1 as a component of SUSE Linux Enterprise Desktop 12 SP4 libarchive13-3.1.2-26.6.1 as a component of SUSE Linux Enterprise Server 12 SP4 libarchive13-3.1.2-26.6.1 as a component of SUSE Linux Enterprise Server 12 SP5 libarchive13-3.1.2-26.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libarchive13-3.1.2-26.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libarchive-devel-3.1.2-26.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libarchive-devel-3.1.2-26.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file. CVE-2016-10209 SUSE Linux Enterprise Desktop 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libarchive-devel-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libarchive-devel-3.1.2-26.6.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193092-1/ https://www.suse.com/security/cve/CVE-2016-10209.html CVE-2016-10209 https://bugzilla.suse.com/1032089 SUSE Bug 1032089 The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. CVE-2016-10349 SUSE Linux Enterprise Desktop 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libarchive-devel-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libarchive-devel-3.1.2-26.6.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193092-1/ https://www.suse.com/security/cve/CVE-2016-10349.html CVE-2016-10349 https://bugzilla.suse.com/1037008 SUSE Bug 1037008 The archive_read_format_cab_read_header function in archive_read_support_format_cab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. CVE-2016-10350 SUSE Linux Enterprise Desktop 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libarchive-devel-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libarchive-devel-3.1.2-26.6.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193092-1/ https://www.suse.com/security/cve/CVE-2016-10350.html CVE-2016-10350 https://bugzilla.suse.com/1037009 SUSE Bug 1037009 An out-of-bounds read flaw exists in parse_file_info in archive_read_support_format_iso9660.c in libarchive 3.3.2 when extracting a specially crafted iso9660 iso file, related to archive_read_format_iso9660_read_header. CVE-2017-14501 SUSE Linux Enterprise Desktop 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libarchive-devel-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libarchive-devel-3.1.2-26.6.1 low 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193092-1/ https://www.suse.com/security/cve/CVE-2017-14501.html CVE-2017-14501 https://bugzilla.suse.com/1059139 SUSE Bug 1059139 read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header. CVE-2017-14502 SUSE Linux Enterprise Desktop 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libarchive-devel-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libarchive-devel-3.1.2-26.6.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193092-1/ https://www.suse.com/security/cve/CVE-2017-14502.html CVE-2017-14502 https://bugzilla.suse.com/1059134 SUSE Bug 1059134 libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar->lzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive. CVE-2018-1000877 SUSE Linux Enterprise Desktop 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libarchive-devel-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libarchive-devel-3.1.2-26.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193092-1/ https://www.suse.com/security/cve/CVE-2018-1000877.html CVE-2018-1000877 https://bugzilla.suse.com/1120653 SUSE Bug 1120653 libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c that can result in Crash/DoS - it is unknown if RCE is possible. This attack appear to be exploitable via the victim must open a specially crafted RAR archive. CVE-2018-1000878 SUSE Linux Enterprise Desktop 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libarchive-devel-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libarchive-devel-3.1.2-26.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193092-1/ https://www.suse.com/security/cve/CVE-2018-1000878.html CVE-2018-1000878 https://bugzilla.suse.com/1120654 SUSE Bug 1120654 libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file. CVE-2019-1000019 SUSE Linux Enterprise Desktop 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libarchive-devel-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libarchive-devel-3.1.2-26.6.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193092-1/ https://www.suse.com/security/cve/CVE-2019-1000019.html CVE-2019-1000019 https://bugzilla.suse.com/1124341 SUSE Bug 1124341 libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file. CVE-2019-1000020 SUSE Linux Enterprise Desktop 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libarchive-devel-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libarchive-devel-3.1.2-26.6.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193092-1/ https://www.suse.com/security/cve/CVE-2019-1000020.html CVE-2019-1000020 https://bugzilla.suse.com/1124342 SUSE Bug 1124342 archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol. CVE-2019-18408 SUSE Linux Enterprise Desktop 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libarchive13-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libarchive-devel-3.1.2-26.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libarchive-devel-3.1.2-26.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193092-1/ https://www.suse.com/security/cve/CVE-2019-18408.html CVE-2019-18408 https://bugzilla.suse.com/1155079 SUSE Bug 1155079