CVE-2023-40477

NameCVE-2023-40477
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3542-1, DLA-3543-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rar (PTS)buster/non-free, bullseye/non-free2:5.5.0-1vulnerable
buster/non-free (security)2:6.23-1~deb10u1fixed
bookworm/non-free2:6.20-0.1vulnerable
trixie/non-free, sid/non-free2:6.23-1fixed
unrar-nonfree (PTS)buster/non-free1:5.6.6-1+deb10u1vulnerable
buster/non-free (security)1:5.6.6-1+deb10u4fixed
bullseye/non-free1:6.0.3-1+deb11u1vulnerable
bookworm/non-free1:6.2.6-1vulnerable
trixie/non-free, sid/non-free1:6.2.11-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rarsourcebuster2:6.23-1~deb10u1DLA-3543-1
rarsource(unstable)2:6.23-1
unrar-nonfreesourcebuster1:5.6.6-1+deb10u4DLA-3542-1
unrar-nonfreesource(unstable)1:6.2.10-1

Notes

[bookworm] - rar <no-dsa> (Non-free not supported)
[bullseye] - rar <no-dsa> (Non-free not supported)
[bookworm] - unrar-nonfree <no-dsa> (Non-free not supported)
[bullseye] - unrar-nonfree <no-dsa> (Non-free not supported)
https://www.zerodayinitiative.com/advisories/ZDI-23-1152/
https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa

Search for package or bug name: Reporting problems