Candidate: CVE-2018-1000879
PublicDate: 2018-12-20 17:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000879
 https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909
 https://github.com/libarchive/libarchive/pull/1105
Description:
 libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards
 (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference
 vulnerability in ACL parser - libarchive/archive_acl.c,
 archive_acl_from_text_l() that can result in Crash/DoS. This attack appear
 to be exploitable via the victim must open a specially crafted archive
 file.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=916962
Priority: medium
Discovered-by:
Assigned-to: leosilva
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H [6.5 MEDIUM]


Patches_libarchive:
 upstream: https://github.com/libarchive/libarchive/pull/1105/commits/15bf44fd2c1ad0e3fd87048b3fcc90c4dcff1175
upstream_libarchive: needs-triage
precise/esm_libarchive: DNE
trusty_libarchive: not-affected (code not present)
trusty/esm_libarchive: not-affected (code not present)
xenial_libarchive: not-affected (code not present)
esm-infra/xenial_libarchive: not-affected (code not present)
bionic_libarchive: not-affected (code not present)
cosmic_libarchive: not-affected (code not present)
devel_libarchive: released (3.3.3-2)