CVE-2012-6706

描述

A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the "DestPos" variable, which allows the attacker to write out of bounds when setting Mem[DestPos].

如何修補 CVE-2012-6706

要修補 CVE-2012-6706,請將受影響套件升級到下列已修補版本。

• —升級至 0.99.4-r0 或更新版本
• —升級至 0.99-4 或更新版本
• —升級至 0.99-0+deb7u2 或更新版本
• —升級至 1:5.5.5-1 或更新版本
• —升級至 1:4.1.4-1+deb7u2 或更新版本

CVE-2012-6706 正在被利用嗎?

中等 — EPSS 為 10.0%,可持續追蹤但非最高優先。

受影響套件(5)

• from 0, < 0.99.4-r0
• from 0, < 0.99-4
• from 0, < 0.99-0+deb7u2
• from 0, < 1:5.5.5-1
• from 0, < 1:4.1.4-1+deb7u2

CVSS 分數

參考連結(2)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2012-6706
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2012-6706