Security update for libarchive

Announcement ID:	SUSE-SU-2019:0831-1
Rating:	moderate
References:	bsc#1120653 bsc#1120654 bsc#1120656 bsc#1120659 bsc#1124341 bsc#1124342
Cross-References:	CVE-2018-1000877 CVE-2018-1000878 CVE-2018-1000879 CVE-2018-1000880 CVE-2019-1000019 CVE-2019-1000020
CVSS scores:	CVE-2018-1000877 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-1000877 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2018-1000878 ( SUSE ): 5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2018-1000878 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2018-1000879 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-1000879 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-1000879 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-1000880 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-1000880 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-1000880 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-1000019 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-1000019 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-1000020 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-1000020 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-1000020 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products:	Basesystem Module 15 Development Tools Module 15 SUSE Linux Enterprise Desktop 15 SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server for SAP Applications 15

An update that solves six vulnerabilities can now be installed.

Description:

This update for libarchive fixes the following issues:

Security issues fixed:

• CVE-2018-1000877: Fixed a double free vulnerability in RAR decoder (bsc#1120653)
• CVE-2018-1000878: Fixed a Use-After-Free vulnerability in RAR decoder (bsc#1120654)
• CVE-2018-1000879: Fixed a NULL Pointer Dereference vulnerability in ACL parser (bsc#1120656)
• CVE-2018-1000880: Fixed an Improper Input Validation vulnerability in WARC parser (bsc#1120659)
• CVE-2019-1000019: Fixed an Out-Of-Bounds Read vulnerability in 7zip decompression (bsc#1124341)
• CVE-2019-1000020: Fixed an Infinite Loop vulnerability in ISO9660 parser (bsc#1124342)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Basesystem Module 15
  zypper in -t patch SUSE-SLE-Module-Basesystem-15-2019-831=1
• Development Tools Module 15
  zypper in -t patch SUSE-SLE-Module-Development-Tools-15-2019-831=1

Package List:

• Basesystem Module 15 (aarch64 ppc64le s390x x86_64)
  • libarchive-debugsource-3.3.2-3.8.4
  • libarchive13-3.3.2-3.8.4
  • libarchive13-debuginfo-3.3.2-3.8.4
  • libarchive-devel-3.3.2-3.8.4
• Development Tools Module 15 (aarch64 ppc64le s390x x86_64)
  • libarchive-debugsource-3.3.2-3.8.4
  • bsdtar-debuginfo-3.3.2-3.8.4
  • bsdtar-3.3.2-3.8.4

References:

• https://www.suse.com/security/cve/CVE-2018-1000877.html
• https://www.suse.com/security/cve/CVE-2018-1000878.html
• https://www.suse.com/security/cve/CVE-2018-1000879.html
• https://www.suse.com/security/cve/CVE-2018-1000880.html
• https://www.suse.com/security/cve/CVE-2019-1000019.html
• https://www.suse.com/security/cve/CVE-2019-1000020.html
• https://bugzilla.suse.com/show_bug.cgi?id=1120653
• https://bugzilla.suse.com/show_bug.cgi?id=1120654
• https://bugzilla.suse.com/show_bug.cgi?id=1120656
• https://bugzilla.suse.com/show_bug.cgi?id=1120659
• https://bugzilla.suse.com/show_bug.cgi?id=1124341
• https://bugzilla.suse.com/show_bug.cgi?id=1124342