Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Libarchive Vulnerability Impacts Multiple Linux Distributions

A vulnerability discovered in multi-format archive and compression library libarchive could lead to arbitrary code execution. 

The compression library is mostly known for being used in software to copy files to and from archives, to create archives, and compress and expand data. 

A vulnerability discovered in multi-format archive and compression library libarchive could lead to arbitrary code execution. 

The compression library is mostly known for being used in software to copy files to and from archives, to create archives, and compress and expand data. 

Because of its capabilities, it has been adopted in a broad range of package managers, archiving tools, file browsers, and operating systems. 

The newly discovered issue, a use-after-free vulnerability, could be abused to cause a denial of service condition, and potentially execute arbitrary code on a vulnerable system. For that, an attacker would have to create a malformed archive to trigger the security flaw during processing. 

Tracked as CVE-2019-18408, the vulnerability was discovered by Google security researchers via OSS-Fuzz, and has been already patched in version 3.4.0 of the archive. 

“archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol,” the bug’s description in the Debian bug tracker reads. 

In addition to Debian, the vulnerability also impacts Ubuntu, Arch Linux, FreeBSD, and NetBSD. Libarchive 3.3.3 is also present in the OpenBSD package repository, although not in the base install. 

macOS and Windows, which also contain the library (since 2009 and 2017, respectively), are not impacted. 

The issue has been addressed in Debian oldstable distribution (stretch) version 3.2.2-2+deb9u2 and stable distribution (buster) version 3.3.3-4+deb10u1. Ubuntu 19.04, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, Ubuntu 14.04 ESM also contain the fix. 

Other Linux distributions have also rolled out updates to keep users protected from the bug. 

Related: Remote Code Execution Flaws Impact Aspose APIs

Related: Flaw in Media Library Impacts VLC, Other Software

Related: Google Removes Vulnerable Library from Android

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Vulnerabilities

Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Vulnerabilities

Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.