CVE-2007-0855

NameCVE-2007-0855
DescriptionStack-based buffer overflow in RARLabs Unrar, as packaged in WinRAR and possibly other products, allows user-assisted remote attackers to execute arbitrary code via a crafted, password-protected archive.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs410580, 410582

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rar (PTS)jessie/non-free2:4.2.0+dfsg.1-0.1fixed
stretch/non-free2:5.4.0+dfsg.1-0.1fixed
bullseye/non-free, sid/non-free, buster/non-free2:5.5.0-1fixed
unrar-nonfree (PTS)jessie/non-free1:5.2.7-0.1+deb8u1fixed
stretch/non-free1:5.3.2-1+deb9u1fixed
buster/non-free1:5.6.6-1fixed
bullseye/non-free, sid/non-free1:5.6.6-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rarsource(unstable)1:3.7b1-1high410582
unrar-nonfreesource(unstable)1:3.7.3-1high410580
unrar-nonfreesourceetch1:3.5.4-1.1
unrar-nonfreesourcesarge1:3.5.2-0.2

Notes

[sarge] - rar <no-dsa> (Non-free)
[etch] - rar <no-dsa> (Non-free)
amavid-new automatically uses "rar -p-" or "unrar -p-",
which probably turns this into remote code execution
clamav can also call unrar -p-, but AFAICS not in default configuration
unrar-free and clamav (which embeds unrar-free code) not affected

Search for package or bug name: Reporting problems