Use-after-free in libarchive - #VU62032

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the archive_read_format_rar_read_data() function when processing RARv4 files. A remote attacker can trick the victim to open a specially crafted archive, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Affected software

Remediation

External References

• https://github.com/libarchive/libarchive/releases/tag/v3.6.1
• https://github.com/libarchive/libarchive/commit/52efa50c69653029687bfc545703b7340b7a51e2

Related Security Bulletins

• Multiple vulnerabilities in libarchive
• Slackware Linux update for libarchive