CVE - CVE-2019-1000019

CVE-ID
CVE-2019-1000019	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
FEDORA:FEDORA-2019-0233ec0ff3 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/ FEDORA:FEDORA-2019-c595a93536 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/ MISC:https://github.com/libarchive/libarchive/pull/1120 MISC:https://github.com/libarchive/libarchive/pull/1120/commits/65a23f5dbee4497064e9bb467f81138a62b0dae1 MLIST:[debian-lts-announce] 20190207 [SECURITY] [DLA 1668-1] libarchive security update URL:https://lists.debian.org/debian-lts-announce/2019/02/msg00013.html REDHAT:RHSA-2019:2298 URL:https://access.redhat.com/errata/RHSA-2019:2298 REDHAT:RHSA-2019:3698 URL:https://access.redhat.com/errata/RHSA-2019:3698 SUSE:openSUSE-SU-2019:1196 URL:http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html SUSE:openSUSE-SU-2019:2615 URL:http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00012.html SUSE:openSUSE-SU-2019:2632 URL:http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00015.html UBUNTU:USN-3884-1 URL:https://usn.ubuntu.com/3884-1/
Assigning CNA
MITRE Corporation
Date Record Created
20190204	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20190204)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)