CVE-2018-1000880: Input Validation
Published Dec 20, 2018
·Updated
Last updated 25 August 2025
Other sources
libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archivereadsupportformatwarc.c, warcread() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.
— Launchpad
Affected Software
13 affected componentsFixes available
Libarchive libarchive>=3.2.0<3.4.0
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=18.10
Fedoraproject Fedora=29
Fedoraproject Fedora=30
openSUSE Leap=15.0
F5 BIG-IP>=17.1.0<=17.1.2
17.5.017.1.2.2
F5 BIG-IP>=16.1.0<=16.1.5
16.1.6
F5 BIG-IP>=15.1.0<=15.1.10
F5 Traffix SDC=5.2.0
debian/libarchive
3.4.3-2+deb11u13.4.3-2+deb11u33.6.2-1+deb12u33.6.2-1+deb12u23.7.4-43.8.5-1
Remediation
Event History
Dec 20, 2018
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
via NVD·05:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Oct 25, 2024
Advisory Published
via F5·08:17 PM
Feb 19, 2026
Data Sourced
via Ubuntu·09:04 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·09:04 PM
Description
Data Sourced
via Debian·09:05 PM
DescriptionAffected Software