bugtraq - [SECURITY] [DSA 4557-1] libarchive security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20191031214927.zulvf4xezfub573r@seger.debian.org>
Date: Thu, 31 Oct 2019 21:49:27 +0000
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 4557-1] libarchive security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4557-1                   security@...ian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
October 31, 2019                      https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libarchive
CVE ID         : CVE-2019-18408

A use-after-free was found in libarchive, a multi-format archive and
compression library, which could result in denial of service and
potentially the execution of arbitrary code is a malformed archive
is processed.

For the oldstable distribution (stretch), this problem has been fixed
in version 3.2.2-2+deb9u2.

For the stable distribution (buster), this problem has been fixed in
version 3.3.3-4+deb10u1.

We recommend that you upgrade your libarchive packages.

For the detailed security status of libarchive please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libarchive

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl27VMgACgkQEMKTtsN8
TjYF4w//a3jeoijlV2mTlwUFmMhH4O9DiczpX9UsPGNH6yOfbR+ojEUyab2E/vcJ
m3BB6VgMvv4eyxR/mp+JMmb36UX8S57kgrC2DjHW8jQ37mVOeEjdVJjGP644vg+T
vY3zjDUNtvTjuo9a0FUr6kYGVpKDrLvnq7zWVHboMTXY3fCOojUBvmvoVZX/PSBB
MtO/AY3bqSq5eeYXRuAZ0Ej9bTa5V90exzjJC8dN6Z0z/JFfN/3Zo4HVHayAxRHP
SM6yO1DU9TmHS90q9ftqk3gJ5hUlmf6Ut9cCf3H3Sxp/+yrfVV3Ye3rtiPIEeZcA
U0iJ1B8f4mHUPH264tiAO0l2ioz6WYkdEB4kQE4MhWS59M/impYeAaiK4k4WB2dd
ZICPfAdlgUQDwGzZeahqWiDZOEMCT7zC3ZewF+WI+aoe7XNeiaydNEwHYk8HWKk+
RSCx01/PT83uGozviPoFfQoy2VFMZmu9xs38wSvaWYrPv4esx5NrgAYsljMdMCCn
8qrDwsgWqQ3nMS5WNI3jQA1grzaulO6mbTJZZ2ThWcKNj8x5yfIL/Vtd8YhdFxAw
WY/xNb8XpdjG+2QpczDrfqnDxltiuLYdti2zA0nfj7VzPAJbjDb0Se3xZrrXRIFA
hpSf3iM2IHJkybzvScyUMV8KuWMtZOyojsk5vTDwytK4jUFTRqM=
=dTO0
-----END PGP SIGNATURE-----