CVE-2020-9308

Published: Feb 20, 2020Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.

Affected (6)

Products: Libarchive: Libarchive · Canonical: Ubuntu Linux · Fedoraproject: Fedora

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libarchive Libarchive	From 3.4.0 to 3.4.2

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.10

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 32

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (14)

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20459

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/libarchive/libarchive/pull/1326

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/libarchive/libarchive/pull/1326/commits/94821008d6eea81e315c5881cdf739202961040a

Source: cve@mitre.org

PatchThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6OTE7GWASH2ZOVG5H3HEN5PR6B3KF7JB/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J76F7VU7HC3GBKG5SAKTRBOFOI3RGO6M/

Source: cve@mitre.org

https://security.gentoo.org/glsa/202003-28

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4293-1/

Source: cve@mitre.org

Third Party Advisory

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20459