CVE-2019-19221

Опубликовано: 21 нояб. 2019

Источник: nvd

CVSS3: 5.5

CVSS2: 2.1

EPSS Низкий

Описание

In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive.

Ссылки

https://github.com/libarchive/libarchive/commit/22b1db9d46654afc6f0c28f90af8cdc84a199f41
Patch
Third Party Advisory
https://github.com/libarchive/libarchive/issues/1276
Exploit
Issue Tracking
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/04/msg00020.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00030.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RHFV25AVTASTWZRF3KTSL357AQ6TYHM4/
https://usn.ubuntu.com/4293-1/
Patch
Third Party Advisory
https://github.com/libarchive/libarchive/commit/22b1db9d46654afc6f0c28f90af8cdc84a199f41
Patch
Third Party Advisory
https://github.com/libarchive/libarchive/issues/1276
Exploit
Issue Tracking
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/04/msg00020.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00030.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RHFV25AVTASTWZRF3KTSL357AQ6TYHM4/
https://usn.ubuntu.com/4293-1/
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:libarchive:libarchive:3.4.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

EPSS

Процентиль: 24%

0.00079

Низкий

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2019-19221

CVSS3: 5.5

ubuntu

около 6 лет назад

In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive.

CVE-2019-19221

CVSS3: 6.5

redhat

около 6 лет назад

In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive.

CVE-2019-19221

CVSS3: 5.5

debian

около 6 лет назад

In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string ...

SUSE-SU-2021:3722-1

suse-cvrf

около 4 лет назад

Security update for libarchive

GHSA-m55v-6hqc-x3jh

CVSS3: 5.5

github

больше 3 лет назад

In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive.

EPSS

Процентиль: 24%

0.00079

Низкий

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-125