CVE-2018-1000878

HIGH 8.8CVE-2018-1000878 · Published 20/12/2018 · updated 17/06/2026

In short

CVE-2018-1000878 is a HIGH (CVSS 8.8) vulnerability affecting libarchive (libarchive).
Chance of exploitation in the next 30 days (EPSS): 4.4%, higher than 91.4% of all vulnerabilities.
Fix: update to 3.4.0 or later.

Package	Affected versions	Patched versions
libarchive libarchive	`≥ 3.1.0, < 3.4.0`	`3.4.0`

Description

libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c that can result in Crash/DoS - it is unknown if RCE is possible. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.

References

lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2019-12/msg00012.html
lists.opensuse.org/opensuse-security-announce/2019-12/msg00015.html
securityfocus.com/bid/106324 · Third Party Advisory
access.redhat.com/errata/RHSA-2019:2298 · Third Party Advisory
access.redhat.com/errata/RHSA-2019:3698
bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909 · Patch
libarchive/libarchive#1105 · Third Party Advisory
libarchive/libarchive#1105 · Patch
lists.debian.org/debian-lts-announce/2018/12/msg00011.html · Third Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG

More vulnerabilities in libarchive

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free