Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:unrar-nonfree User: [email protected] Usertags: pu
[ Reason ] Backport of non-DSA CVE-2026-14191. [ Impact ] Users are vulnerable to out-of-heap writes. [ Tests ] Only compile-tested and extracted one rar5 file. [ Risks ] Bounds checks for two variables are pretty trivial. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] One patch backporting the changes in recvol5.cpp of v7.2.7 to 7.1.8. [ Other info ] Non-maintainer request.
diff -Nru unrar-nonfree-7.1.8/debian/changelog unrar-nonfree-7.1.8/debian/changelog --- unrar-nonfree-7.1.8/debian/changelog 2025-06-27 03:34:13.000000000 +0200 +++ unrar-nonfree-7.1.8/debian/changelog 2026-09-01 16:05:21.000000000 +0200 @@ -1,3 +1,9 @@ +unrar-nonfree (1:7.1.8-1+deb13u1) trixie; urgency=medium + + * Backport the fix for CVE-2026-14191 + + -- Bastian Germann <[email protected]> Tue, 01 Sep 2026 16:05:21 +0200 + unrar-nonfree (1:7.1.8-1) unstable; urgency=medium * New upstream version 7.1.8 diff -Nru unrar-nonfree-7.1.8/debian/patches/0014-CVE-2026-14191.patch unrar-nonfree-7.1.8/debian/patches/0014-CVE-2026-14191.patch --- unrar-nonfree-7.1.8/debian/patches/0014-CVE-2026-14191.patch 1970-01-01 01:00:00.000000000 +0100 +++ unrar-nonfree-7.1.8/debian/patches/0014-CVE-2026-14191.patch 2026-09-01 16:02:53.000000000 +0200 @@ -0,0 +1,23 @@ +Subject: Backport CVE-2026-14191 fix from version 7.2.7 +--- +--- a/recvol5.cpp ++++ b/recvol5.cpp +@@ -460,9 +460,16 @@ uint RecVolumes5::ReadHeader(File *RecFile,bool FirstRev) + + if (Raw.Get1()!=1) // Version check. + return 0; +- DataCount=Raw.Get2(); +- RecCount=Raw.Get2(); ++ ++ uint CurDataCount=Raw.Get2(); ++ uint CurRecCount=Raw.Get2(); ++ if (!FirstRev && (CurDataCount!=DataCount || CurRecCount!=RecCount)) ++ return 0; ++ ++ DataCount=CurDataCount; ++ RecCount=CurRecCount; + TotalCount=DataCount+RecCount; ++ + uint RecNum=Raw.Get2(); // Number of recovery volume. + if (RecNum>=TotalCount || TotalCount>MaxVolumes) + return 0; diff -Nru unrar-nonfree-7.1.8/debian/patches/series unrar-nonfree-7.1.8/debian/patches/series --- unrar-nonfree-7.1.8/debian/patches/series 2025-06-27 03:02:52.000000000 +0200 +++ unrar-nonfree-7.1.8/debian/patches/series 2026-09-01 16:04:43.000000000 +0200 @@ -11,3 +11,4 @@ 0011-Add-visibility-attribute-to-reduce-export-table.patch 0012-Add-PHONY-target.patch 0013-Avoid-internal-compiler-error-on-i386.patch +0014-CVE-2026-14191.patch
