SB2019032150 - Fedora 30 update for libarchive

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Double-free error (CVE-ID: CVE-2018-1000877)

The vulnerability allows a remote attacker to cause DoS condition.

The vulnerability exists due to double-free error in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar->lzss.window, new_size) with new_size = 0. A remote attacker can trick the victim into opening a specially crafted RAR archive and cause the service to crash.

2) Use-after-free error (CVE-ID: CVE-2018-1000878)

The vulnerability allows a remote attacker to cause DoS condition.

The vulnerability exists due to use-after-free error in RAR decoder - libarchive/archive_read_support_format_rar.c. A remote attacker can trick the victim into opening a specially crafted RAR archive and cause the service to crash.

3) NULL pointer dereference (CVE-ID: CVE-2018-1000879)

The vulnerability allows a remote attacker to cause DoS condition.

The vulnerability exists due to NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l(). A remote attacker can trick the victim into opening a specially crafted RAR archive and cause the service to crash.

4) Improper input validation (CVE-ID: CVE-2018-1000880)

The vulnerability allows a remote attacker to cause DoS condition.

The vulnerability exists due to insufficient validation of user-supplied input in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. A remote attacker can trick the victim into opening a specially crafted RAR archive and cause the service to crash.

5) Out-of-bounds read (CVE-ID: CVE-2019-1000019)

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in the header_bytes() function in  archive_read_support_format_7zip.c when decompressing 7zip archives. A remote attacker can create a specially crafted 7zip file, trick the victim into opening it, trigger out-of-bounds read error and crash the affected application.

6) Resource exhaustion (CVE-ID: CVE-2019-1000020)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper parsing of ISO9660 files. A remote attacker can  persuade a user to access an ISO9660, trigger an infinite loop condition and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-2019-fbe83d0e32