CVE-2018-11496: Use After Free

Published May 26, 2018

Updated

In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in readstream in stream.c, because decompressfile in lrzip.c lacks certain size validation.

Affected Software

2 affected components

Long Range Zip Project Long Range Zip=0.631

Debian Debian Linux=9.0

Event History

May 26, 2018

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is CVE-2018-11496?

CVE-2018-11496 is a vulnerability in Long Range Zip (lrzip) 0.631 that allows for a use-after-free in read_stream in stream.c.

What is the severity of CVE-2018-11496?

CVE-2018-11496 has a severity rating of 6.5 (medium).

How does CVE-2018-11496 affect Long Range Zip?

CVE-2018-11496 affects Long Range Zip version 0.631 by causing a use-after-free vulnerability in the read_stream function in stream.c.

How can I fix CVE-2018-11496?

To fix CVE-2018-11496, update your Long Range Zip installation to a version that includes the necessary size validation in the decompress_file function in lrzip.c.

Where can I find more information about CVE-2018-11496?

You can find more information about CVE-2018-11496 at the following links: [link1](https://github.com/ckolivas/lrzip/issues/96), [link2](https://lists.debian.org/debian-lts-announce/2021/08/msg00001.html).