CVE-2011-1779
published 2012-04-13CVE-2011-1779: Multiple use-after-free vulnerabilities in libarchive 2.8.4 and 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly have…
PriorityP428high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
1.37%
68.8th percentile
Multiple use-after-free vulnerabilities in libarchive 2.8.4 and 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted (1) TAR archive or (2) ISO9660 image.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libarchive | < libarchive 3.0.4-2 (bookworm) | libarchive 3.0.4-2 (bookworm) |
| freebsd | libarchive | — | — |
| freebsd | libarchive | — | — |
| libarchive | libarchive | >= 0 < 3.0.4-2 | 3.0.4-2 |
| libarchive | libarchive | >= 0 < 3.0.4-2 | 3.0.4-2 |
| libarchive | libarchive | >= 0 < 3.0.4-2 | 3.0.4-2 |
| libarchive | libarchive | >= 0 < 3.0.4-2 | 3.0.4-2 |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xm97-4p58-pfr9: Multiple use-after-free vulnerabilities in libarchive 2
ghsa_unreviewed·2022-05-17
CVE-2011-1779 [HIGH] GHSA-xm97-4p58-pfr9: Multiple use-after-free vulnerabilities in libarchive 2
Multiple use-after-free vulnerabilities in libarchive 2.8.4 and 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted (1) TAR archive or (2) ISO9660 image.
OSV
CVE-2011-1779: Multiple use-after-free vulnerabilities in libarchive 2
osv·2012-04-13·CVSS 7.5
CVE-2011-1779 [HIGH] CVE-2011-1779: Multiple use-after-free vulnerabilities in libarchive 2
Multiple use-after-free vulnerabilities in libarchive 2.8.4 and 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted (1) TAR archive or (2) ISO9660 image.
Debian
CVE-2011-1779: libarchive - Multiple use-after-free vulnerabilities in libarchive 2.8.4 and 2.8.5 allow remo...
vendor_debian·2011·CVSS 7.5
CVE-2011-1779 [HIGH] CVE-2011-1779: libarchive - Multiple use-after-free vulnerabilities in libarchive 2.8.4 and 2.8.5 allow remo...
Multiple use-after-free vulnerabilities in libarchive 2.8.4 and 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted (1) TAR archive or (2) ISO9660 image.
Scope: local
bookworm: resolved (fixed in 3.0.4-2)
bullseye: resolved (fixed in 3.0.4-2)
forky: resolved (fixed in 3.0.4-2)
sid: resolved (fixed in 3.0.4-2)
trixie: resolved (fixed in 3.0.4-2)
Red Hat
Libarchive multiple security issues
vendor_redhat·2010-12-30·CVSS 7.5
CVE-2011-1779 [HIGH] Libarchive multiple security issues
Libarchive multiple security issues
Multiple use-after-free vulnerabilities in libarchive 2.8.4 and 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted (1) TAR archive or (2) ISO9660 image.
Statement: Not vulnerable. This issue did not affect the versions of libarchive as shipped with Red Hat Enterprise Linux 4, 5, and 6.
Package: libarchive (Red Hat Enterprise Linux 6) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2010-4666 CVE-2011-1777 CVE-2011-1778 CVE-2011-1779 Libarchive multiple security issues [epel-5]
bugzilla·2012-01-12·CVSS 7.5
CVE-2010-4666 [HIGH] CVE-2010-4666 CVE-2011-1777 CVE-2011-1778 CVE-2011-1779 Libarchive multiple security issues [epel-5]
CVE-2010-4666 CVE-2011-1777 CVE-2011-1778 CVE-2011-1779 Libarchive multiple security issues [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/up
Bugzilla
CVE-2010-4666 CVE-2011-1777 CVE-2011-1778 CVE-2011-1779 Libarchive multiple security issues [fedora-all]
bugzilla·2011-05-18·CVSS 7.5
CVE-2010-4666 [HIGH] CVE-2010-4666 CVE-2011-1777 CVE-2011-1778 CVE-2011-1779 Libarchive multiple security issues [fedora-all]
CVE-2010-4666 CVE-2011-1777 CVE-2011-1778 CVE-2011-1779 Libarchive multiple security issues [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=705849
Please not
Bugzilla
CVE-2010-4666 CVE-2011-1777 CVE-2011-1778 CVE-2011-1779 Libarchive multiple security issues
bugzilla·2011-05-18·CVSS 7.5
CVE-2010-4666 [HIGH] CVE-2010-4666 CVE-2011-1777 CVE-2011-1778 CVE-2011-1779 Libarchive multiple security issues
CVE-2010-4666 CVE-2011-1777 CVE-2011-1778 CVE-2011-1779 Libarchive multiple security issues
A number of flaws have been corrected in upstream libarchive that have not yet been included in a public release of libarchive (latest version is 2.8.4).
A buffer overflow at reading bit lengths of huffman code of LZX when reading a broken CAB file (CVE-2010-4666) [1].
Buffer overflows in various functions related to reading archives (in archive_read_support_format_iso9660.c) (CVE-2011-1777) [2].
Buffer overflow in reading tar archives (CVE-2011-1778) [3].
Use-after-free bugs (CVE-2011-1779) [4].
[1] http://code.google.com/p/libarchive/source/detail?r=2842
[2] http://code.google.com/p/libarchive/source/detail?r=3158
[3] http://code.google.com/p/libarchive/source/detail?r=3160
[4] http://code.g
2012-04-13
Published