unrar (SUSE:OpenStack Cloud 8) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:OpenStack Cloud 8 package unrar, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (6)

• CVE-2012-6706 — CVSS 9.8 (critical): A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and…
• CVE-2017-12940 — CVSS 9.8 (critical): libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function.
• CVE-2017-12941 — CVSS 9.8 (critical): libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function.
• CVE-2017-12942 — CVSS 9.8 (critical): libunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ function.
• CVE-2017-20006 — CVSS 7.8 (high): UnRAR 5.6.1.2 and 5.6.1.3 has a heap-based buffer overflow in Unpack::CopyString (called from Unpack::Unpack5 and CmdExtract::ExtractCurrent…
• CVE-2017-12938 — CVSS 7.5 (high): UnRAR before 5.5.7 allows remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the…