debian/xar vulnerabilities

Latest debian/xar CVEs

Newest publication first

1. CVE-2017-11125 libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.

   Published 2017-07-10

   Critical·CVSS 9.8 EPSS 2.0%

   libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.

2. CVE-2017-11124 libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_unserialize function in archive.c.

   Published 2017-07-10

   Critical·CVSS 9.8 EPSS 2.0%

   libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_unserialize function in archive.c.

3. CVE-2010-3798 Heap-based buffer overflow in xar in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted xar archive.

   Published 2010-11-16

   Medium·CVSS 6.8 EPSS 3.3%

   Heap-based buffer overflow in xar in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted xar archive.

4. CVE-2010-0055 xar in Apple Mac OS X 10.5.8 does not properly validate package signatures, which allows attackers to have an unspecified impact via a modified package.

   Published 2010-03-30

   High·CVSS 10.0 EPSS 2.0%

   xar in Apple Mac OS X 10.5.8 does not properly validate package signatures, which allows attackers to have an unspecified impact via a modified package.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.