VulnerableCode Package Details - pkg:deb/debian/unrar-nonfree@1:6.0.3-1%2Bdeb11u1

Search for packages

Package details: pkg:deb/debian/unrar-nonfree@1:6.0.3-1%2Bdeb11u1

Essentials
History (0)

purl	pkg:deb/debian/unrar-nonfree@1:6.0.3-1%2Bdeb11u1
Tags	Ghost

Next non-vulnerable version	1:7.1.6-1
Latest non-vulnerable version	1:7.1.6-1
Risk	7.8

Vulnerabilities affecting this package (2)

Vulnerability	Summary	Fixed by
VCID-pkqm-2dfr-aaak Aliases: CVE-2022-48579	UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.	1:6.0.3-1+deb11u3 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-w1x3-c3xc-aaab Aliases: CVE-2023-40477	RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21233.	1:6.0.3-1+deb11u3 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 1:6.2.6-1+deb12u1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-pkqm-2dfr-aaak
Aliases:
CVE-2022-48579

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

1:6.0.3-1+deb11u3
Affected by 1 other vulnerability.

VCID-w1x3-c3xc-aaab
Aliases:
CVE-2023-40477

RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21233.

1:6.0.3-1+deb11u3
Affected by 1 other vulnerability.

1:6.2.6-1+deb12u1
Affected by 1 other vulnerability.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version