CVE-2019-19221 Memory corruption in n/a

Medium 5.5 Published 21 Nov 2019 Updated 5 Aug 2024

An out-of-bounds read in Libarchive allows attackers to cause a denial of service via a crafted archive file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-19221?

CVE-2019-19221 is a medium-severity memory corruption vulnerability in Canonical Ubuntu Linux, published on 21 Nov 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive.

Weakness: CWE-125

Which versions are affected by CVE-2019-19221?

It affects 4 products.

Linux distribution packages (17)

`libarchive-devel` AlmaLinux:8	All versions	`3.3.2-9.el8`
`bsdcat-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:3.3.2-9.el8`
`bsdcpio-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:3.3.2-9.el8`
`bsdtar` Red Hat:enterprise_linux:8::baseos	All versions	`0:3.3.2-9.el8`
`bsdtar-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:3.3.2-9.el8`
`libarchive` Red Hat:enterprise_linux:8::baseos	All versions	`0:3.3.2-9.el8`
`libarchive-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:3.3.2-9.el8`
`libarchive-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:3.3.2-9.el8`
`bsdcat-debuginfo` Red Hat:enterprise_linux:8::crb	All versions	`0:3.3.2-9.el8`
`bsdcpio-debuginfo` Red Hat:enterprise_linux:8::crb	All versions	`0:3.3.2-9.el8`
`bsdtar-debuginfo` Red Hat:enterprise_linux:8::crb	All versions	`0:3.3.2-9.el8`
`libarchive-debuginfo` Red Hat:enterprise_linux:8::crb	All versions	`0:3.3.2-9.el8`
`libarchive-debugsource` Red Hat:enterprise_linux:8::crb	All versions	`0:3.3.2-9.el8`
`libarchive-devel` Red Hat:enterprise_linux:8::crb	All versions	`0:3.3.2-9.el8`
`libarchive` SUSE:Linux Enterprise Server 12 SP5	All versions	`3.3.3-32.5.1`
`libarchive` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`3.3.3-32.5.1`
`libarchive` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`3.3.3-32.5.1`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Libarchive Libarchive.

How do I fix CVE-2019-19221?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2019-19221 being exploited?

There is no known exploitation of CVE-2019-19221 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2019-19221, ALSA-2020:4443, DEBIAN-CVE-2019-19221, GHSA-m55v-6hqc-x3jh, RHSA-2020:4443, SUSE-SU-2021:3722-1 and 2 more.