REDHAT-BUG-2493411: Medium severity Libarchive libarchive vulnerability
A double-free vulnerability exists in the libarchive RAR5 reader subsystem within archivereadsupportformatrar5.c where the state tracking pointer rar->cstate.filteredbuf can be linked to a temporary filter output block during archive decompression. When the unpacking engine subsequently processes an adjacent file or resets its internal state layout via initunpack(), it releases the allocation mapped to filteredbuf but fails to clear or nullify the underlying pointer variable. A specially crafted RAR5 archive can exploit this lingering dangling pointer by forcing a secondary release operation on the exact same memory address, triggering a standard memory-manager abort that immediately crashes the application and results in a Denial of Service (DoS).
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2493411?
The severity of REDHAT-BUG-2493411 is medium, classified as 4.
How do I fix REDHAT-BUG-2493411?
To fix REDHAT-BUG-2493411, update libarchive to the latest version where the vulnerability has been addressed.
What causes the vulnerability in REDHAT-BUG-2493411?
The vulnerability in REDHAT-BUG-2493411 is caused by a double-free condition in the libarchive RAR5 reader subsystem.
What impact does REDHAT-BUG-2493411 have on my system?
REDHAT-BUG-2493411 can potentially lead to memory corruption and may allow an attacker to execute arbitrary code during archive decompression.
Is REDHAT-BUG-2493411 present in all versions of libarchive?
REDHAT-BUG-2493411 is specific to certain versions of libarchive; it's important to check the version you are using.