CVE-2018-1000877: Double Free
A double free vulnerability was found in libarchive in RAR decoder. A crafted archive could cause the application to crash.
Upstream issue:
https://github.com/libarchive/libarchive/pull/1105
Upstream patch:
https://github.com/libarchive/libarchive/pull/1105/commits/021efa522ad729ff0f5806c4ce53e4a6cc1daa31
Other sources
CVE-2018-1000877 libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archivereadsupportformatrar.c, parsecodes(), realloc(rar->lzss.window, newsize) with newsize = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive. CVE-2018-1000878 libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archivereadsupportformatrar.c that can result in Crash/DoS - it is unknown if RCE is possible. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.
— F5
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-1000877?
CVE-2018-1000877 is a vulnerability in libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards).
Which software versions are affected by CVE-2018-1000877?
libarchive versions between 3.1.0 and 3.4.0 are affected by CVE-2018-1000877.
What is the severity of CVE-2018-1000877?
CVE-2018-1000877 has a severity of 8.8 (high).
How can I fix CVE-2018-1000877?
To fix CVE-2018-1000877, update libarchive to version 3.1.2-7ubuntu2.7 (for Ubuntu trusty), 3.1.2-11ubuntu0.16.04.5 (for Ubuntu xenial), 3.2.2-3.1ubuntu0.2 (for Ubuntu bionic), 3.2.2-5ubuntu0.1 (for Ubuntu cosmic), or any of the fixed versions provided by Debian.
Where can I find more information about CVE-2018-1000877?
You can find more information about CVE-2018-1000877 at these references: [Bug report in Launchpad](https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909) and [GitHub pull request](https://github.com/libarchive/libarchive/pull/1105).