lrzip 0.631-1+deb9u1build0.18.04.1: lrzip 0.631-1+deb9u1build0.18.04.1 for Ubuntu 18.04.6 LTS (bionic)

lrzip 0.631-1+deb9u1build0.18.04.1, released May 26, 2018, fixes 14 CVEs in lrzip. None of them is reported as exploited. Patch Radar priority: Routine. The product is no longer supported.

RoutineUnsupported product

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

n/a

No CVSS score published

Highest EPSS

0.0240

84th percentile

Priority of the 14 CVEs

Patch now 0
                                Urgent 0
                                High 0
                                Routine 14

Fixed package versions

Product	Release	Fixed in
lrzip	Ubuntu 18.04.6 LTS (bionic)	0.631-1+deb9u1build0.18.04.1

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Routine	CVE-2018-10685	lrzip: In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the lzma_decompress_buf function of stream.c, which...	n/a	0.0240	None reported
Routine	CVE-2017-8844	lrzip: The read_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (...	n/a	0.0160	None reported
Routine	CVE-2017-8842	lrzip: The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a den...	n/a	0.0157	None reported
Routine	CVE-2017-8846	lrzip: The read_stream function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of servi...	n/a	0.0157	None reported
Routine	CVE-2017-8843	lrzip: The join_pthread function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of serv...	n/a	0.0138	None reported
Routine	CVE-2017-8847	lrzip: The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a den...	n/a	0.0138	None reported
Routine	CVE-2017-8845	lrzip: The lzo1x_decompress function in lzo1x_d.ch in LZO 2.08, as used in lrzip 0.631, allows remote attackers to cause a d...	n/a	0.0136	None reported
Routine	CVE-2018-5786	lrzip: lrzip - security update	n/a	0.0133	None reported
Routine	CVE-2018-11496	lrzip: In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in read_stream in stream.c, because decompress_file in...	n/a	0.0124	None reported
Routine	CVE-2018-5747	lrzip: In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the ucompthread function (stream.c)	n/a	0.0123	None reported
Routine	CVE-2018-5650	lrzip: In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the unzip_match function in ru...	n/a	0.0117	None reported
Routine	CVE-2018-9058	lrzip: In Long Range Zip (aka lrzip) 0.631, there is an infinite loop in the runzip_fd function of runzip.c	n/a	0.0114	None reported
Routine	CVE-2017-9929	lrzip: In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:1074, which allows attacker...	n/a	0.0105	None reported
Routine	CVE-2017-9928	lrzip: In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:979, which allows attackers...	n/a	0.0101	None reported

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.