CVE-2018-14346

NameCVE-2018-14346
DescriptionGNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1478-1, DSA-4290-1
Debian Bugs904903

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libextractor (PTS)bullseye1:1.11-2fixed
bookworm1:1.11-7fixed
sid, trixie1:1.13-7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libextractorsourcejessie1:1.3-2+deb8u2DLA-1478-1
libextractorsourcestretch1:1.3-4+deb9u2DSA-4290-1
libextractorsource(unstable)1:1.7-1904903

Notes

http://lists.gnu.org/archive/html/bug-libextractor/2018-07/msg00001.html
https://git.gnunet.org/libextractor.git/commit/?id=ad19e7fe0adc99d5710eff1ed48d91a7b75a950e
Search for package or bug name: Reporting problems