Fluid Attacks Database

Description

Stack-based buffer overflow in RARLabs Unrar, as packaged in WinRAR and possibly other products, allows user-assisted remote attackers to execute arbitrary code via a crafted, password-protected archive.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	rar	=1:3.5.1-1 \|\| =1:3.6.0-1 \|\| =2.02-2 \|\| =2.60-1 \|\| =2.80-2 \|\| =3.30-2 \|\| >=0 <1:3.7b1-1	1:3.7b1-1
debian 13	unrar-nonfree	=1:3.5.2-0.1 \|\| =1:3.5.2-0.2 \|\| =1:3.5.4-0.1 \|\| =1:3.5.4-1 \|\| =1:3.5.4-1.1 \|\| =1:3.7.2-1 \|\| =3.3.6-2 \|\| =3.3.6-2.0.1 \|\| =3.4.3-1 \|\| >=0 <1:3.7.3-1	1:3.7.3-1
debian 12	rar	=1:3.5.1-1 \|\| =1:3.6.0-1 \|\| =2.02-2 \|\| =2.60-1 \|\| =2.80-2 \|\| =3.30-2 \|\| >=0 <1:3.7b1-1	1:3.7b1-1
debian 13	rar	=1:3.5.1-1 \|\| =1:3.6.0-1 \|\| =2.02-2 \|\| =2.60-1 \|\| =2.80-2 \|\| =3.30-2 \|\| >=0 <1:3.7b1-1	1:3.7b1-1
debian 12	unrar-nonfree	=1:3.5.2-0.1 \|\| =1:3.5.2-0.2 \|\| =1:3.5.4-0.1 \|\| =1:3.5.4-1 \|\| =1:3.5.4-1.1 \|\| =1:3.7.2-1 \|\| =3.3.6-2 \|\| =3.3.6-2.0.1 \|\| =3.4.3-1 \|\| >=0 <1:3.7.3-1	1:3.7.3-1
debian 14	unrar-nonfree	=1:3.5.2-0.1 \|\| =1:3.5.2-0.2 \|\| =1:3.5.4-0.1 \|\| =1:3.5.4-1 \|\| =1:3.5.4-1.1 \|\| =1:3.7.2-1 \|\| =3.3.6-2 \|\| =3.3.6-2.0.1 \|\| =3.4.3-1 \|\| >=0 <1:3.7.3-1	1:3.7.3-1

Aliases

1. CVE-2007-08552. NVD-2007-08553. OSV-DEBIAN-2007-08554. OSV-2007-08555. SECURITY-TRACKER-CVE-2007-0855

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.