Nixpkgs Security Tracker

Login with GitHub

Suggestion detail

Untriaged
created 1 day, 20 hours ago
Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

References

Affected products

rhcos
libarchive

Matching in nixpkgs

Package maintainers