CVE-2019-1000019

    Dashboard / Vulnerabilities / CVE-2019-1000019

    CVE-2019-1000019

    Published: 4 Feb 2019Last Modified: 7 Aug 2026

    Summary:

    Details: libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.

    References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00012.html, http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00015.html, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/, http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html, https://access.redhat.com/errata/RHSA-2019:2298, https://access.redhat.com/errata/RHSA-2019:3698, https://github.com/libarchive/libarchive/pull/1120, https://lists.debian.org/debian-lts-announce/2019/02/msg00013.html, https://usn.ubuntu.com/3884-1/, https://github.com/libarchive/libarchive/pull/1120/commits/65a23f5dbee4497064e9bb467f81138a62b0dae1

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 47de2fbd77d215c4ffaaee6d5dc59394be2ed89a
    Fixed -614110e76d9dbb9ed3e159a71cbd75fa3b23efe3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High