Wind River Support Network

HomeDefectsLINCD-435

Fixed

LINCD-435 : Security Advisory - libarchive - CVE-2019-19221

Created: Nov 21, 2019 Updated: Sep 13, 2022

Resolved Date: Dec 13, 2019

Previous ID: LIN1019-3579

Found In Version: 10.20.3.0

Fix Version: 10.20.3.0

Severity: Standard

Applicable for: Wind River Linux CD

Component/s: Userspace

Description

In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive.

CREATE(Triage):(User=admin) CVE-2019-19221 (https://nvd.nist.gov/vuln/detail/CVE-2019-19221)

CVEs

CVE-2019-19221