A vulnerability discovered in multi-format archive and compression library libarchive could lead to arbitrary code execution.
The compression library is mostly known for being used in software to copy files to and from archives, to create archives, and compress and expand data.
Because of its capabilities, it has been adopted in a broad range of package managers, archiving tools, file browsers, and operating systems.
The newly discovered issue, a use-after-free vulnerability, could be abused to cause a denial of service condition, and potentially execute arbitrary code on a vulnerable system. For that, an attacker would have to create a malformed archive to trigger the security flaw during processing.
Tracked as CVE-2019-18408, the vulnerability was discovered by Google security researchers via OSS-Fuzz, and has been already patched in version 3.4.0 of the archive.
“archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol,” the bug’s description in the Debian bug tracker reads.
In addition to Debian, the vulnerability also impacts Ubuntu, Arch Linux, FreeBSD, and NetBSD. Libarchive 3.3.3 is also present in the OpenBSD package repository, although not in the base install.
macOS and Windows, which also contain the library (since 2009 and 2017, respectively), are not impacted.
The issue has been addressed in Debian oldstable distribution (stretch) version 3.2.2-2+deb9u2 and stable distribution (buster) version 3.3.3-4+deb10u1. Ubuntu 19.04, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, Ubuntu 14.04 ESM also contain the fix.
Other Linux distributions have also rolled out updates to keep users protected from the bug.
Related: Remote Code Execution Flaws Impact Aspose APIs