Your submission was sent successfully! Close

CVE-2012-6706

Published: 22 June 2017

A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the "DestPos" variable, which allows the attacker to write out of bounds when setting Mem[DestPos].

Priority

Medium

CVSS 3 base score: 9.8

Status

Package Release Status
libclamunrar
Launchpad, Ubuntu, Debian
Upstream
Released (0.99-4)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (0.99-4ubuntu1)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (0.99-1ubuntu0.1)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was released [0.99-0ubuntu0.14.04.2])
unrar-nonfree
Launchpad, Ubuntu, Debian
Upstream
Released (1:5.3.2-1+deb9u1, 1:5.5.5-1)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(5.5.8-1)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (1:5.3.2-1+deb9u1build0.16.04.1)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was needed)