Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

SUSE: 2021:2834-1 Moderate: Unrar Buffer Overflow Threat

suse
Calendar Grey August 25, 2021
Dist Suse Esm H88
SUSE Security Notification for unrar: addresses 6 vulnerabilities. Notice ID: SUSE-SU-2021:2834-1 with a moderate severity level.
An update that fixes 6 vulnerabilities, contains one feature is now available

Summary

This update for unrar to version 5.6.1 fixes several issues. These security issues were fixed: - CVE-2017-12938: Prevent remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file (bsc#1054038). - CVE-2017-12940: Prevent out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function (bsc#1054038). - CVE-2017-12941: Prevent an out-of-bounds read in the Unpack::Unpack20 function (bsc#1054038). - CVE-2017-12942: Prevent a buffer overflow in the Unpack::LongLZ function (bsc#1054038). - CVE-2017-20006: Fixed heap-based buffer overflow in Unpack:CopyString (bsc#1187974). These non-security issues were fixed:

Topics%20covered

Topics Covered

security advisory moderate buffer overflow exploit SUSE unrar

References

#1046882 #1054038 #1187974 SLE-20843

Cross- CVE-2012-6706 CVE-2017-12938 CVE-2017-12940

CVE-2017-12941 CVE-2017-12942 CVE-2017-20006

CVSS scores:

CVE-2012-6706 (SUSE): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2017-12938 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE-2017-12938 (SUSE): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVE-2017-12940 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2017-12940 (SUSE): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVE-2017-12941 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2017-12941 (SUSE): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVE-2017-12942 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:2834-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate buffer overflow exploit SUSE unrar

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here