CVE-2019-18408: canonical ubuntu_linux Use After Free
CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2019-18408RHSA-2020:0203RHSA-2020:0246RHSA-2020:0271UBUNTU-CVE-2019-18408USN-4169-1DEBIAN-CVE-2019-18408DLA-1971-1DSA-4557-1
Published 24-10-2019Last modified 05-08-2024
Vulnerability summary
CVE-2019-18408 is a high (CVSS 7.5) Use After Free vulnerability in canonical ubuntu_linux. EPSS estimates a 4.04% chance of exploitation in the next 30 days, higher than 90.4% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
4.04%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 6Timeline
- 24-10-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources5 sources · 7.5–8.1
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
4.04%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 4.04% on 18-09-2026
18-09-202618-10-2026
EPSS score4.04%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat9 products
- bsdcat-debuginfo< 0:3.3.2-4.el8_0 | < 0:3.3.2-8.el8_1
- bsdcpio< 0:3.1.2-14.el7_7
- bsdcpio-debuginfo< 0:3.3.2-4.el8_0 | < 0:3.3.2-8.el8_1
- bsdtar< 0:3.1.2-14.el7_7 | < 0:3.3.2-4.el8_0 | < 0:3.3.2-8.el8_1
- bsdtar-debuginfo< 0:3.3.2-4.el8_0 | < 0:3.3.2-8.el8_1
Debian2 products
- libarchive< 3.4.0-1 | < 3.2.2-2+deb9u2 | < 3.3.3-4+deb10u1 | < 3.1.2-11+deb8u8
- debian_linuxEOL8.0
Alpine1 product
- libarchive< 3.3.3-r1 | < 3.4.0-r0
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 19.04
Libarchive1 product
- libarchive< 3.4.0
Ubuntu1 product
- libarchive< 3.1.2-7ubuntu2.8+esm1 | < 3.1.2-11ubuntu0.16.04.7 | < 3.2.2-3.1ubuntu0.5
6 vendors · 15 products
References
27 links- github.com/libarchive/libarchive/commit/b8592ecba2f9e451e1f5cb7ab6dcee8b8e7b3f60X Refsource MISCREPORTPatchThird Party Advisory
- github.com/libarchive/libarchive/compare/v3.3.3...v3.4.0X Refsource MISCREPORTRelease NotesThird Party Advisory
lists.debian.org/debian-lts-announce/2019/10/msg00034.htmlMailing ListX Refsource MLISTThird Party Advisory
