Unarr
Monthly
Heap-based out-of-bounds read in unarr through 1.1.1 lets a crafted ZIP archive crash any host application that links the library and passes it attacker-controlled input. The defect is in zip_parse_extra_fields() in zip/parse-zip.c, where an incorrect length check on the ZIP64 extra-field record allows reads past the end of a heap buffer when an archive supplies 0xFFFFFFFF sentinel values together with a truncated ZIP64 record; the demonstrated impact ceiling is a denial of service (process crash), with no confidentiality or integrity compromise and no code execution indicated. Exploitation requires the malicious archive to reach the victim and be opened or processed by the vulnerable application (local attack vector, passive user interaction, no privileges required), and no public exploit identified at time of analysis - this is a moderate-severity, low-priority issue rather than an urgent one.
An off-by-one heap-based buffer overflow in unarr through 1.1.1 (CWE-193) lets a crafted TAR archive that carries a fully populated ustar prefix field together with a full name field trigger a single out-of-bounds NUL write in tar_get_name() when an application calls the ar_entry_get_name() API. The flaw is reachable without authentication (CVSS PR:N) but is local/file-based (CVSS 3.1 AV:L, UI:R), requiring an application that links unarr to open or process attacker-controlled archive input; the assessed impact is bounded to heap corruption and process crash (availability) with no confidentiality loss and only minor integrity effect. No public exploit identified at time of analysis, the package is not listed in CISA KEV, and no vendor-released patch has been identified.
Heap-based out-of-bounds read in unarr through 1.1.1 lets a crafted ZIP archive crash any host application that links the library and passes it attacker-controlled input. The defect is in zip_parse_extra_fields() in zip/parse-zip.c, where an incorrect length check on the ZIP64 extra-field record allows reads past the end of a heap buffer when an archive supplies 0xFFFFFFFF sentinel values together with a truncated ZIP64 record; the demonstrated impact ceiling is a denial of service (process crash), with no confidentiality or integrity compromise and no code execution indicated. Exploitation requires the malicious archive to reach the victim and be opened or processed by the vulnerable application (local attack vector, passive user interaction, no privileges required), and no public exploit identified at time of analysis - this is a moderate-severity, low-priority issue rather than an urgent one.
An off-by-one heap-based buffer overflow in unarr through 1.1.1 (CWE-193) lets a crafted TAR archive that carries a fully populated ustar prefix field together with a full name field trigger a single out-of-bounds NUL write in tar_get_name() when an application calls the ar_entry_get_name() API. The flaw is reachable without authentication (CVSS PR:N) but is local/file-based (CVSS 3.1 AV:L, UI:R), requiring an application that links unarr to open or process attacker-controlled archive input; the assessed impact is bounded to heap corruption and process crash (availability) with no confidentiality loss and only minor integrity effect. No public exploit identified at time of analysis, the package is not listed in CISA KEV, and no vendor-released patch has been identified.