Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2019-1000020: libarchive can hang when opening malicious ISO files
CVE-2019-1000020 · published 7 years ago
Summary
Versions of the libarchive library from 2.8.0 onward have a problem in the code that reads ISO9660 disc images. If a user opens a specially crafted ISO file, the program can get stuck in an endless loop, causing the application to stop responding. Upgrade to a patched libarchive release or avoid loading untrusted ISO files until the fix is applied.
What to do
- Update debian libarchive to version 3.3.3-4.
- Update libarchive libarchive to version 3.4.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | libarchive |
< 3.3.3-4 Fix: upgrade to 3.3.3-4
|
| Debian:13 | debian | libarchive |
< 3.3.3-4 Fix: upgrade to 3.3.3-4
|
| Debian:14 | debian | libarchive |
< 3.3.3-4 Fix: upgrade to 3.3.3-4
|
| – | libarchive | libarchive |
>= 2.8.0, < 3.4.0 cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
14.04 16.04 18.04 18.10 cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* |
| – | debian | debian_linux |
8.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
29 cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* |
| – | opensuse | leap |
15.0 cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_desktop |
7.0 cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_server |
7.0 cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_workstation |
7.0 cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* |
Original advisory text
libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO96...
libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file.
References
- https://security-tracker.debian.org/tracker/CVE-2019-1000020 Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html Mailing List Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00015.html
- https://access.redhat.com/errata/RHSA-2019:2298 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3698
- https://github.com/libarchive/libarchive/pull/1120 Third Party Advisory
- https://github.com/libarchive/libarchive/pull/1120/commits/8312eaa576014cd9b9650... Patch Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/02/msg00013.html Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://usn.ubuntu.com/3884-1/ Third Party Advisory
Severity
6.5
Medium
Type
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
Timeline
Published4 Feb 2019
Updated31 Oct 2026
First seen10 Sep 2026
Track software like this
Free during beta