Strix
26.1K

CVE-2019-1000019

MEDIUMCVSS 6.5/10EPSS 3.41%

Last modified

CVE-2019-1000019 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.. EPSS estimates a 3.41% chance of exploitation in the next 30 days.

Description

libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.

Metrics

CVSS 3.1
6.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Probability
3.41%

87.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
LibarchiveLibarchive>= 3.0.2, < 3.4.0
DebianDebian Linux8.0
CanonicalUbuntu Linux14.04
CanonicalUbuntu Linux16.04
CanonicalUbuntu Linux18.04
CanonicalUbuntu Linux18.10
FedoraprojectFedora28
FedoraprojectFedora29
OpensuseLeap15.0
RedhatEnterprise Linux Desktop7.0
RedhatEnterprise Linux Server7.0
RedhatEnterprise Linux Workstation7.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-1000019?
libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.
How severe is CVE-2019-1000019?
CVE-2019-1000019 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 3.41% probability of exploitation in the next 30 days.
How do I fix CVE-2019-1000019?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-1000019?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST