CVE-2012-6706 A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. A...
CriticalCVSS 9.8
EPSS 10.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the "DestPos" variable, which allows the attacker to write out of bounds when setting Mem[DestPos].
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libclamunrar(Debian:12) | < 0.99-4 | 0.99-4 |
| debian/libclamunrar(Debian:12) | = 0.95.1-1 | No fix listed |
| debian/libclamunrar(Debian:12) | = 0.95.2-1 | No fix listed |
| debian/libclamunrar(Debian:12) | = 0.95.3-1 | No fix listed |
| debian/libclamunrar(Debian:12) | = 0.95.3-1~volatile1 | No fix listed |
| debian/libclamunrar(Debian:12) | = 0.96-1 | No fix listed |
| debian/libclamunrar(Debian:12) | = 0.96-2 | No fix listed |
| debian/libclamunrar(Debian:12) | = 0.96-2~volatile1 | No fix listed |
| debian/libclamunrar(Debian:12) | = 0.96.4-1 | No fix listed |
| debian/libclamunrar(Debian:12) | = 0.96.4-1~volatile1 | No fix listed |
| debian/libclamunrar(Debian:12) | = 0.98.1-1 | No fix listed |
| debian/libclamunrar(Debian:12) | = 0.98.5-1 | No fix listed |
| debian/libclamunrar(Debian:12) | = 0.99-1 | No fix listed |
| debian/libclamunrar(Debian:12) | = 0.99-2 | No fix listed |
| debian/libclamunrar(Debian:12) | = 0.99-3 | No fix listed |
| debian/libclamunrar(Debian:13) | < 0.99-4 | 0.99-4 |
| debian/libclamunrar(Debian:13) | = 0.95.1-1 | No fix listed |
| debian/libclamunrar(Debian:13) | = 0.95.2-1 | No fix listed |
| debian/libclamunrar(Debian:13) | = 0.95.3-1 | No fix listed |
| debian/libclamunrar(Debian:13) | = 0.95.3-1~volatile1 | No fix listed |
| debian/libclamunrar(Debian:13) | = 0.96-1 | No fix listed |
| debian/libclamunrar(Debian:13) | = 0.96-2 | No fix listed |
| debian/libclamunrar(Debian:13) | = 0.96-2~volatile1 | No fix listed |
| debian/libclamunrar(Debian:13) | = 0.96.4-1 | No fix listed |
| debian/libclamunrar(Debian:13) | = 0.96.4-1~volatile1 | No fix listed |
Show 144 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libclamunrar(Debian:13) | = 0.98.1-1 | No fix listed |
| debian/libclamunrar(Debian:13) | = 0.98.5-1 | No fix listed |
| debian/libclamunrar(Debian:13) | = 0.99-1 | No fix listed |
| debian/libclamunrar(Debian:13) | = 0.99-2 | No fix listed |
| debian/libclamunrar(Debian:13) | = 0.99-3 | No fix listed |
| debian/libclamunrar(Debian:14) | < 0.99-4 | 0.99-4 |
| debian/libclamunrar(Debian:14) | = 0.95.1-1 | No fix listed |
| debian/libclamunrar(Debian:14) | = 0.95.2-1 | No fix listed |
| debian/libclamunrar(Debian:14) | = 0.95.3-1 | No fix listed |
| debian/libclamunrar(Debian:14) | = 0.95.3-1~volatile1 | No fix listed |
| debian/libclamunrar(Debian:14) | = 0.96-1 | No fix listed |
| debian/libclamunrar(Debian:14) | = 0.96-2 | No fix listed |
| debian/libclamunrar(Debian:14) | = 0.96-2~volatile1 | No fix listed |
| debian/libclamunrar(Debian:14) | = 0.96.4-1 | No fix listed |
| debian/libclamunrar(Debian:14) | = 0.96.4-1~volatile1 | No fix listed |
| debian/libclamunrar(Debian:14) | = 0.98.1-1 | No fix listed |
| debian/libclamunrar(Debian:14) | = 0.98.5-1 | No fix listed |
| debian/libclamunrar(Debian:14) | = 0.99-1 | No fix listed |
| debian/libclamunrar(Debian:14) | = 0.99-2 | No fix listed |
| debian/libclamunrar(Debian:14) | = 0.99-3 | No fix listed |
| debian/unrar-nonfree(Debian:12) | < 1:5.5.5-1 | 1:5.5.5-1 |
| debian/unrar-nonfree(Debian:12) | = 1:3.5.2-0.1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.5.2-0.2 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.5.4-0.1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.5.4-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.5.4-1.1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.7.2-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.7.3-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.7.3-1.1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.7.8-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.7.8-2 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.8.2-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.8.4-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.8.5-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.8.5-2 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.9.10-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.9.3-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.9.5-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.9.6-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.9.7-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:3.9.9-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:4.0.2-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:4.0.3-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:4.1.4-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:4.2.4-0.1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:4.2.4-0.2 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:4.2.4-0.3 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:5.0.10-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:5.2.5-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:5.2.7-0.1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:5.3.2-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 1:5.4.5-1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 3.3.6-2 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 3.3.6-2.0.1 | No fix listed |
| debian/unrar-nonfree(Debian:12) | = 3.4.3-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | < 1:5.5.5-1 | 1:5.5.5-1 |
| debian/unrar-nonfree(Debian:13) | = 1:3.5.2-0.1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.5.2-0.2 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.5.4-0.1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.5.4-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.5.4-1.1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.7.2-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.7.3-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.7.3-1.1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.7.8-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.7.8-2 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.8.2-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.8.4-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.8.5-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.8.5-2 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.9.10-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.9.3-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.9.5-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.9.6-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.9.7-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:3.9.9-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:4.0.2-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:4.0.3-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:4.1.4-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:4.2.4-0.1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:4.2.4-0.2 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:4.2.4-0.3 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:5.0.10-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:5.2.5-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:5.2.7-0.1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:5.3.2-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 1:5.4.5-1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 3.3.6-2 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 3.3.6-2.0.1 | No fix listed |
| debian/unrar-nonfree(Debian:13) | = 3.4.3-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | < 1:5.5.5-1 | 1:5.5.5-1 |
| debian/unrar-nonfree(Debian:14) | = 1:3.5.2-0.1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.5.2-0.2 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.5.4-0.1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.5.4-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.5.4-1.1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.7.2-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.7.3-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.7.3-1.1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.7.8-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.7.8-2 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.8.2-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.8.4-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.8.5-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.8.5-2 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.9.10-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.9.3-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.9.5-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.9.6-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.9.7-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:3.9.9-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:4.0.2-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:4.0.3-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:4.1.4-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:4.2.4-0.1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:4.2.4-0.2 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:4.2.4-0.3 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:5.0.10-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:5.2.5-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:5.2.7-0.1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:5.3.2-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 1:5.4.5-1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 3.3.6-2 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 3.3.6-2.0.1 | No fix listed |
| debian/unrar-nonfree(Debian:14) | = 3.4.3-1 | No fix listed |
| sophos threat detection engine | <= 3.36.2 | No fix listed |
| rarlab UnRAR | <= 5.5.4 | No fix listed |
| alpine/clamav(Alpine:v3.10) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.11) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.12) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.13) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.14) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.15) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.16) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.17) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.18) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.19) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.20) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.21) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.22) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.23) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.24) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.8) | < 0.99.4-r0 | 0.99.4-r0 |
| alpine/clamav(Alpine:v3.9) | < 0.99.4-r0 | 0.99.4-r0 |
References
- Debian Security Tracker CVE-2012-6706 vendor-advisory
- securitytracker.com third-party-advisory
- telussecuritylabs.com third-party-advisory
- bugs.chromium.org exploit third-party-advisory
- community.sophos.com vendor-advisory
- kc.mcafee.com
- lock.cmpxchg8b.com third-party-advisory
- nakedsecurity.sophos.com vendor-advisory
- GLSA-201708-05 vendor-advisory
- GLSA-201709-24 vendor-advisory
- GLSA-201804-16 vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking