In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:979, which allows attackers to cause a denial of service via a crafted file.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5171-2 advisory.

    USN-5171-1 fixed vulnerabilities in Long Range ZIP. This update provides the corresponding updates for     Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5171-1 advisory.

    It was discovered that Long Range ZIP incorrectly handled certain specially crafted lrz files. A remote     attacker could possibly use this issue to cause a denial of service (crash) or other unspecified impact.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-2725 advisory.

    Several security vulnerabilities have been discovered in lrzip, a compression program. Heap-based and     stack buffer overflows, use-after-free and infinite loops would allow attackers to cause a denial of     service or possibly other unspecified impact via a crafted file. For Debian 9 stretch, these problems have     been fixed in version 0.631-1+deb9u1. We recommend that you upgrade your lrzip packages. For the detailed     security status of lrzip please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/lrzip Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202005-01 (Long Range ZIP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Long Range ZIP. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted       archive file possibly resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
183703	Ubuntu 16.04 ESM : Long Range ZIP vulnerabilities (USN-5171-2)	Nessus	Ubuntu Local Security Checks	critical
155943	Ubuntu 18.04 LTS : Long Range ZIP vulnerabilities (USN-5171-1)	Nessus	Ubuntu Local Security Checks	critical
152170	Debian DLA-2725-1 : lrzip - LTS security update	Nessus	Debian Local Security Checks	critical
136538	GLSA-202005-01 : Long Range ZIP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2017-9928

medium

Tenable Plugins

critical

critical

critical

high