Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-18408: archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol. 1769979: CVE-2019-18408 libarchive: use-after-free in archive_read_format_rar_read_data when there is an error in the decompression of an archive entry
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | bsdcpio | 0:3.1.2-14.amzn2 |
| Amazon Linux · 2 | bsdtar | 0:3.1.2-14.amzn2 |
| Amazon Linux · 2 | libarchive | 0:3.1.2-14.amzn2 |
| Amazon Linux · 2 | libarchive-debuginfo | 0:3.1.2-14.amzn2 |
| Amazon Linux · 2 | libarchive-devel | 0:3.1.2-14.amzn2 |
Vulnerabilities 1
-
Unscored —
archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-18408.html