{"schema_version":"1.7.3","id":"SUSE-SU-2021:2834-1","published":"2021-08-25T10:26:54Z","modified":"2026-02-04T03:16:37.694807Z","related":["CVE-2012-6706","CVE-2017-12938","CVE-2017-12940","CVE-2017-12941","CVE-2017-12942","CVE-2017-20006"],"upstream":["CVE-2012-6706","CVE-2017-12938","CVE-2017-12940","CVE-2017-12941","CVE-2017-12942","CVE-2017-20006"],"summary":"Security update for unrar","details":"This update for unrar to version 5.6.1 fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-12938: Prevent remote attackers to bypass a directory-traversal\n  protection mechanism via vectors involving a symlink to the . directory, a\n  symlink to the .. directory, and a regular file (bsc#1054038).\n- CVE-2017-12940: Prevent out-of-bounds read in the EncodeFileName::Decode call\n  within the Archive::ReadHeader15 function (bsc#1054038).\n- CVE-2017-12941: Prevent an out-of-bounds read in the Unpack::Unpack20\n  function (bsc#1054038).\n- CVE-2017-12942: Prevent a buffer overflow in the Unpack::LongLZ function\n  (bsc#1054038).\n- CVE-2017-20006: Fixed heap-based buffer overflow in Unpack:CopyString (bsc#1187974).\n\nThese non-security issues were fixed:\n\n- Added extraction support for .LZ archives created by Lzip compressor\n- Enable unpacking of files in ZIP archives compressed with XZ algorithm and\n  encrypted with AES\n- Added support for PAX extended headers inside of TAR archive\n- If RAR recovery volumes (.rev files) are present in the same folder as usual\n  RAR volumes, archive test command verifies .rev contents after completing\n  testing .rar files\n- By default unrar skips symbolic links with absolute paths in link target when\n  extracting unless -ola command line switch is specified\n- Added support for AES-NI CPU instructions\n- Support for a new RAR 5.0 archiving format\n- Wildcard exclusion mask for folders\n- Prevent conditional jumps depending on uninitialised values (bsc#1046882)\n","affected":[{"package":{"name":"unrar","ecosystem":"SUSE:OpenStack Cloud 8","purl":"pkg:rpm/suse/unrar&distro=SUSE%20OpenStack%20Cloud%208"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.5.1"}]}],"ecosystem_specific":{"binaries":[{"unrar":"5.6.1-4.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:2834-1.json"}},{"package":{"name":"unrar","ecosystem":"SUSE:OpenStack Cloud 9","purl":"pkg:rpm/suse/unrar&distro=SUSE%20OpenStack%20Cloud%209"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.5.1"}]}],"ecosystem_specific":{"binaries":[{"unrar":"5.6.1-4.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:2834-1.json"}},{"package":{"name":"unrar","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","purl":"pkg:rpm/suse/unrar&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.5.1"}]}],"ecosystem_specific":{"binaries":[{"unrar":"5.6.1-4.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:2834-1.json"}},{"package":{"name":"unrar","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","purl":"pkg:rpm/suse/unrar&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.5.1"}]}],"ecosystem_specific":{"binaries":[{"unrar":"5.6.1-4.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:2834-1.json"}},{"package":{"name":"unrar","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","purl":"pkg:rpm/suse/unrar&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.5.1"}]}],"ecosystem_specific":{"binaries":[{"unrar":"5.6.1-4.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:2834-1.json"}},{"package":{"name":"unrar","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","purl":"pkg:rpm/suse/unrar&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.5.1"}]}],"ecosystem_specific":{"binaries":[{"libunrar-devel":"5.6.1-4.5.1","libunrar5_6_1":"5.6.1-4.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:2834-1.json"}},{"package":{"name":"unrar","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","purl":"pkg:rpm/suse/unrar&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.5.1"}]}],"ecosystem_specific":{"binaries":[{"unrar":"5.6.1-4.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:2834-1.json"}},{"package":{"name":"unrar","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","purl":"pkg:rpm/suse/unrar&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.5.1"}]}],"ecosystem_specific":{"binaries":[{"unrar":"5.6.1-4.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:2834-1.json"}},{"package":{"name":"unrar","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","purl":"pkg:rpm/suse/unrar&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCL"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.5.1"}]}],"ecosystem_specific":{"binaries":[{"unrar":"5.6.1-4.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:2834-1.json"}},{"package":{"name":"unrar","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","purl":"pkg:rpm/suse/unrar&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.5.1"}]}],"ecosystem_specific":{"binaries":[{"unrar":"5.6.1-4.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:2834-1.json"}},{"package":{"name":"unrar","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","purl":"pkg:rpm/suse/unrar&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.5.1"}]}],"ecosystem_specific":{"binaries":[{"unrar":"5.6.1-4.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:2834-1.json"}},{"package":{"name":"unrar","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","purl":"pkg:rpm/suse/unrar&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.5.1"}]}],"ecosystem_specific":{"binaries":[{"unrar":"5.6.1-4.5.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:2834-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212834-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1046882"},{"type":"REPORT","url":"https://bugzilla.suse.com/1054038"},{"type":"REPORT","url":"https://bugzilla.suse.com/1187974"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2012-6706"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-12938"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-12940"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-12941"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-12942"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-20006"}]}