リモートの Debian 11 ホストには、dla-3950 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    - ------------------------------------------------------------------------- Debian LTS アドバイザリ DLA-3950-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/Adrian Bunk 2024 年 11 月 11 日 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    パッケージ: libarchive バージョン: 3.4.3-2+deb11u2 CVE ID: CVE-2021-36976 CVE-2022-26280 CVE-2022-36227 CVE-2024-20696 Debian バグ: 991442 1008953 1024669 1086155

    マルチフォーマットのアーカイブおよび圧縮ライブラリである libarchive の複数の脆弱性が修正されました。

    CVE-2021-36976

        RAR リーダーのメモリ解放後使用 (use-after-free)

    CVE-2022-26280

        ZIP リーダーの領域外読み取り

    CVE-2022-36227

        archive_write NULL デリファレンス

    CVE-2024-20696

        RAR リーダーの領域外書き込み

    Debian 11 bullseye においては、これらの問題はバージョン 3.4.3-2+deb11u2 で修正されました。

    お使いの libarchive パッケージをアップグレードすることを推奨します。

    libarchive の詳細なセキュリティステータスについては、そのセキュリティトラッカーページを参照してください。
    https://security-tracker.debian.org/tracker/libarchive

    Debian LTS セキュリティアドバイザリに関する詳細、これらの更新をシステムに適用する方法、およびよくある質問については、こちらを参照してください。https://wiki.debian.org/LTS

Tenable は、前述の説明ブロックを Debian セキュリティアドバイザリから直接抽出しました。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1803-1 advisory.

  - Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.
    (CVE-2022-26280)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-5252 advisory.

    [3.5.3-2]
    - Resolves: CVE-2022-26280

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.
    (CVE-2022-26280)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.
    (CVE-2022-26280)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1930-1 advisory.

  - An error in the lha_read_file_header_1() function (archive_read_support_format_lha.c) in libarchive 3.2.2     allows remote attackers to trigger an out-of-bounds read memory access and subsequently cause a crash via     a specially crafted archive. (CVE-2017-5601)

  - libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and     process_block). (CVE-2021-36976)

  - Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.
    (CVE-2022-26280)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3950 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3950-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     November 11, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libarchive     Version        : 3.4.3-2+deb11u2     CVE ID         : CVE-2021-36976 CVE-2022-26280 CVE-2022-36227 CVE-2024-20696     Debian Bug     : 991442 1008953 1024669 1086155

    Multiple vulnerabilities have been fixed in libarchive,     a multi-format archive and compression library.

    CVE-2021-36976

        RAR reader use-after-free

    CVE-2022-26280

        ZIP reader out-of-bounds-read

    CVE-2022-36227

        archive_write NULL dereference

    CVE-2024-20696

        RAR reader out-of-bounds write

    For Debian 11 bullseye, these problems have been fixed in version     3.4.3-2+deb11u2.

    We recommend that you upgrade your libarchive packages.

    For the detailed security status of libarchive please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libarchive

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
210823	Debian dla-3950 : libarchive-dev - セキュリティ更新	Nessus	Debian Local Security Checks	11/12/2024	11/12/2024	critical
161469	SUSE SLED15 / SLES15 Security Update : libarchive (SUSE-SU-2022:1803-1)	Nessus	SuSE Local Security Checks	5/24/2022	7/14/2023	medium
162796	Oracle Linux 9 : libarchive (ELSA-2022-5252)	Nessus	Oracle Linux Local Security Checks	7/7/2022	10/22/2024	medium
165389	EulerOS Virtualization 2.9.1 : libarchive (EulerOS-SA-2022-2349)	Nessus	Huawei Local Security Checks	9/23/2022	10/11/2023	medium
165781	EulerOS 2.0 SP10 : libarchive (EulerOS-SA-2022-2429)	Nessus	Huawei Local Security Checks	10/8/2022	10/10/2023	medium
161821	SUSE SLED15 / SLES15 Security Update : libarchive (SUSE-SU-2022:1930-1)	Nessus	SuSE Local Security Checks	6/3/2022	7/14/2023	medium
210823	Debian dla-3950 : libarchive-dev - security update	Nessus	Debian Local Security Checks	11/12/2024	11/12/2024	critical

Detections

Analytics

Plugins Search

critical

medium

medium

medium

medium

medium

critical