CVE-2019-1000019: Medium severity Libarchive libarchive vulnerability
CVE-2019-1000020 libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archivereadsupportformatiso9660.c, readCE()/parserockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file. CVE-2019-1000019 libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archivereadsupportformat7zip.c, headerbytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.
Other sources
libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archivereadsupportformat7zip.c, headerbytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.
References: https://github.com/libarchive/libarchive/pull/1120/commits/65a23f5dbee4497064e9bb467f81138a62b0dae1 https://github.com/libarchive/libarchive/pull/1120
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2019-1000019.
What is the severity of CVE-2019-1000019?
The severity of CVE-2019-1000019 is medium (6.5).
How does CVE-2019-1000019 affect libarchive?
CVE-2019-1000019 affects libarchive versions starting from commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards).
How can CVE-2019-1000019 be exploited?
CVE-2019-1000019 can be exploited through a crash (denial of service) caused by an out-of-bounds read vulnerability in the 7zip decompression function of libarchive.
What is the Common Weakness Enumeration (CWE) ID of CVE-2019-1000019?
The CWE ID of CVE-2019-1000019 is CWE-125: Out-of-bounds Read.