Bug 624426

Summary:	app-arch/xar: NULL pointer dereference in xar_unserialize (archive.c)
Product:	Gentoo Security	Reporter:	Christopher Díaz Riveros (RETIRED) <chrisadr>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	trivial	CC:	mgorny, prefix
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/mackyle/xar/issues/17
Whiteboard:	~4[noglsa cve]
Package list:		Runtime testing required:	---

Description Christopher Díaz Riveros (RETIRED) gentoo-dev

2017-07-10 11:52:18 UTC

References:

https://blogs.gentoo.org/ago/2017/06/28/xar-null-pointer-dereference-in-xar_unserialize-archive-c/

Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev

2017-07-21 03:59:01 UTC

Package has no maintainer, CCing maintainer-needed

Comment 2 Michał Górny archtester

2018-01-19 19:35:10 UTC

Supposedly fixed in 1.8 (according to bug #624642).

Comment 3 Fabian Groffen gentoo-dev

2018-01-19 19:39:37 UTC

Yes the confirming in bug #624642 was done using a Gentoo Linux amd64 box.

Comment 4 Aaron Bauman (RETIRED) gentoo-dev

2018-01-19 20:19:52 UTC

Same issue reported in duplicate bug.  CVE freed.

*** This bug has been marked as a duplicate of bug 624642 ***