CVE-2020-9308

archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.

• CWE-787

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20459Issue Tracking, Patch, Third Party Advisory
• https://github.com/libarchive/libarchive/pull/1326Patch, Third Party Advisory
• https://github.com/libarchive/libarchive/pull/1326/commits/94821008d6eea81e315c5881cdf739202961040aPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6OTE7GWASH2ZOVG5H3HEN5PR6B3KF7JB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J76F7VU7HC3GBKG5SAKTRBOFOI3RGO6M/
• https://security.gentoo.org/glsa/202003-28Third Party Advisory
• https://usn.ubuntu.com/4293-1/Third Party Advisory
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20459Issue Tracking, Patch, Third Party Advisory
• https://github.com/libarchive/libarchive/pull/1326Patch, Third Party Advisory
• https://github.com/libarchive/libarchive/pull/1326/commits/94821008d6eea81e315c5881cdf739202961040aPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6OTE7GWASH2ZOVG5H3HEN5PR6B3KF7JB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J76F7VU7HC3GBKG5SAKTRBOFOI3RGO6M/
• https://security.gentoo.org/glsa/202003-28Third Party Advisory
• https://usn.ubuntu.com/4293-1/Third Party Advisory

Published

Feb 20, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9298The Spinnaker template resolution functionality is vulnerabl…7.5
• CVE-2020-9299There were XSS vulnerabilities discovered and reported in th…5.4
• CVE-2020-9300The Access Control issues include allowing a regular user to…6.5
• CVE-2020-9301Nolan Ray from Apple Information Security identified a secur…8.8
• CVE-2020-9306Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has…8.8
• CVE-2020-9307Hirschmann OS2, RSP, and RSPE devices before HiOS 08.3.00 al…6.5
• CVE-2020-9309Silverstripe CMS through 4.5 can be susceptible to script ex…8.8
• CVE-2020-9310Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-9311In SilverStripe through 4.5, malicious users with a valid Si…5.4
• CVE-2020-9314** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web…4.8
• CVE-2020-9315** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web…7.5
• CVE-2020-9318Red Gate SQL Monitor 9.0.13 through 9.2.14 allows an adminis…7.2